remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions to install various Remotion-specific packages (e.g., @remotion/three, @remotion/media, @remotion/lottie) using package managers like npx, yarn, and pnpm. These are official framework dependencies.
- [EXTERNAL_DOWNLOADS]: Code examples demonstrate fetching assets and data from remote URLs, including remotion.media, lottiefiles.com, and placeholder API domains. These are documented neutrally as they represent standard asset loading.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by processing external data which is subsequently used for rendering or metadata calculation. 1. Ingestion points: rules/calculate-metadata.md (API responses), rules/import-srt-captions.md (SRT files), and rules/lottie.md (Lottie JSON). 2. Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the examples. 3. Capability inventory: The skill utilizes network fetching (fetch) and file reading (staticFile). 4. Sanitization: No sanitization or validation of the fetched content is demonstrated in the examples before the data is used in rendering.
Audit Metadata