remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- External Data Ingestion: The skill provides multiple examples of using
fetch()to retrieve external JSON data for Lottie animations and dynamic composition metadata. While this is a core feature of the Remotion framework for creating dynamic videos, it creates a surface for indirect prompt injection where an agent might process untrusted data from an external API. - Ingestion points:
rules/calculate-metadata.md,rules/compositions.md, andrules/lottie.md. - Boundary markers: Not explicitly defined in the logic.
- Capability inventory: Includes network operations and file writing examples.
- Sanitization: Standard React JSX usage is shown, but explicit validation of external API responses is not detailed.
- Package Installation and Remote Assets: The skill recommends installing various
@remotion/*scoped packages and industry-standard libraries likezodandmapbox-gl. It also references remote assets fromremotion.mediaandlottiefiles.com. These references are consistent with the skill's purpose and target established, well-known services. - Subprocess Interaction: The
rules/transcribe-captions.mdfile contains a commented-out example of usingexecSyncto runffmpeg. While spawning shell processes warrants caution regarding input sanitization, this pattern is a standard requirement for media processing workflows and is presented as an informational snippet.
Audit Metadata