remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • External Data Ingestion: The skill provides multiple examples of using fetch() to retrieve external JSON data for Lottie animations and dynamic composition metadata. While this is a core feature of the Remotion framework for creating dynamic videos, it creates a surface for indirect prompt injection where an agent might process untrusted data from an external API.
  • Ingestion points: rules/calculate-metadata.md, rules/compositions.md, and rules/lottie.md.
  • Boundary markers: Not explicitly defined in the logic.
  • Capability inventory: Includes network operations and file writing examples.
  • Sanitization: Standard React JSX usage is shown, but explicit validation of external API responses is not detailed.
  • Package Installation and Remote Assets: The skill recommends installing various @remotion/* scoped packages and industry-standard libraries like zod and mapbox-gl. It also references remote assets from remotion.media and lottiefiles.com. These references are consistent with the skill's purpose and target established, well-known services.
  • Subprocess Interaction: The rules/transcribe-captions.md file contains a commented-out example of using execSync to run ffmpeg. While spawning shell processes warrants caution regarding input sanitization, this pattern is a standard requirement for media processing workflows and is presented as an informational snippet.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 03:59 PM
Security Audit — agent-trust-hub — remotion-best-practices