The Agent Skills Directory

EXTERNAL_DOWNLOADS (MEDIUM): Multiple rules (e.g., rules/3d.md, rules/audio.md, rules/fonts.md) instruct the agent to install external packages using npx remotion add. These packages are from the @remotion scope, which is not on the Trusted GitHub Organizations list.
COMMAND_EXECUTION (MEDIUM): The rules/cli.md, rules/ffmpeg.md, and rules/transparent-videos.md files provide specific command-line instructions for the agent to execute npx remotion and bunx remotion ffmpeg. These allow the agent to perform file system operations and media rendering on the host machine.
REMOTE_CODE_EXECUTION (MEDIUM): The rules/transcribe-captions.md and rules/voiceover.md rules provide full Node.js scripts that the agent is expected to write to disk and execute. These scripts perform network requests and call installWhisperCpp, which downloads external binaries (Whisper.cpp) and models.
PROMPT_INJECTION (LOW): Found surface for Indirect Prompt Injection (Category 8).
Ingestion points: rules/calculate-metadata.md and rules/compositions.md instruct the agent to use fetch() to retrieve data from URLs provided in props (e.g., props.dataUrl, props.videoId).
Boundary markers: Absent in the examples; fetched data is parsed as JSON and used directly in composition logic.
Capability inventory: The agent has the ability to execute CLI commands (npx remotion), write files to the public/ directory, and execute Node.js scripts.
Sanitization: No sanitization or validation of the fetched JSON content is demonstrated before it is used to influence render parameters or component props.

remotion-best-practices