Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This package is a set of Markdown guidance and TypeScript/TSX examples for building videos with Remotion. It covers composition setup, animation, assets, audio and video, captions, fonts, charts, transitions, metadata, and rendering behavior. The files include shell examples for installing Remotion packages and code examples that fetch remote URLs, but no hidden scripts, base64 blobs, file writes, persistence, or credential collection were found. The publisher's own card notes that package installs and remote asset workflows should be reviewed. Overall, the skill matches its declared documentation purpose, but a careful user should approve package install commands and remote fetches before use.
| Declared purpose | Best practices for Remotion - Video creation in React. |
| Observed behavior | The package provides Markdown rule files and TypeScript/TSX examples. It repeatedly shows shell commands such as `npx remotion add ...`, `bunx remotion add ...`, `yarn remotion add ...`, and `pnpm exec remotion add ...` for installing Remotion packages. It also includes examples that fetch or display remote URLs including example.com, remotion.media, api.example.com, assets4.lottiefiles.com, and remotion.dev. No executable payloads or hidden runtime behavior were observed. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Examples fetch remote media, captions, Lottie assets, documentation, and placeholder API data. URLs include example.com, remotion.media, api.example.com, assets4.lottiefiles.com, and remotion.dev. |
| shell | needed | Rule files contain bash code examples such as `npx remotion add @remotion/three` and `bunx remotion add @remotion/media`; running them executes package-manager commands. |
| install_packages | needed | Multiple rules direct package installation using `remotion add` via npm, bun, yarn, or pnpm to add Remotion packages. |
| filesystem_read | needed | Guides reference loading local assets from the public folder using staticFile() or fetch(), including fonts, images, videos, audio, and .srt files. |
| payments | exceeds purpose | Documentation mentions the OpenAI Whisper API transcription option requires payment; the skill does not implement payment itself. |
| severity | finding |
|---|---|
| info | Declared scope States the skill is for Remotion-specific guidance; no broader or hidden behavior is described. SKILL.md:10 Use this skills whenever you are dealing with Remotion code to obtain the domain-specific knowledge. |
| low | Shell package install example The skill directs running a package-manager command that can modify project dependencies. rules/3d.md:19 npx remotion add @remotion/three # If project uses npm |
| low | Repeated install command Another package install example; this pattern appears across many rule files. rules/audio.md:16 npx remotion add @remotion/media # If project uses npm |
| low | Remote API fetch example Example computes metadata from an external API using a parameterized placeholder URL. rules/compositions.md:117 const data = await fetch(`https://api.example.com/video/${props.videoId}`, { |
| low | Third-party Lottie asset fetch Example fetches animation JSON from a third-party domain at render time. rules/lottie.md:42 fetch('https://assets4.lottiefiles.com/packages/lf20_zyquagfl.json') |
| info | Documentation fetch instruction Directs fetching official Remotion docs; no hidden network destination. rules/tailwind.md:11 Tailwind must be installed and enabled first in a Remotion project - fetch https://www.remotion.dev/docs/tailwind using WebFetch for instructions. |
| low | Paid API option mentioned Mentions a cloud transcription option that costs money; the skill does not initiate payment. rules/transcribe-captions.md:18 - `@remotion/openai-whisper` - Use OpenAI Whisper API for cloud-based transcription. Fast and no server needed, but requires payment. |
| info | Publisher acknowledges install risk The package card itself warns that install commands should be reviewed. skill-card.md:24 Risk: Package-manager commands in the examples could change a project dependency graph if run without review. |
| info | Publisher acknowledges remote URL risk The package card recommends validating or allowlisting remote URLs. skill-card.md:28 Risk: Remote URLs used for media, captions, Lottie assets, or metadata extraction can introduce reliability and server-side rendering exposure. |
| info | Placeholder remote image URL Uses example.com as a placeholder; not a runtime destination. rules/assets.md:71 <Img src="https://example.com/image.png" /> |
| info | Local subtitle file read Example reads a project-local .srt file; no exfiltration behavior. rules/import-srt-captions.md:41 const response = await fetch(staticFile('subtitles.srt')); |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.example.com | not in the service index | rules/compositions.md:117 |
| assets4.lottiefiles.com | not in the service index | rules/lottie.md:42 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| example.com | not in the service index | rules/assets.md:71 |
| remotion.dev | not in the service index | rules/transcribe-captions.md:13 |
| remotion.media | not in the service index | rules/assets.md:72 |
| www.remotion.dev | not in the service index | rules/tailwind.md:11 |
| Binaries invoked | bash, npm, npx |
| Environment variables read | COLOR_AXIS |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 43 | 94c893d93051dff9… |
_meta.json | 6 | 469d5f7b23615c8f… |
rules/3d.md | 86 | 2a5b1a72de35168b… |
rules/animations.md | 29 | 99a6377d64061af5… |
rules/assets.md | 78 | 664160a48fe6ef76… |
rules/assets/charts-bar-chart.tsx | 173 | 6e5e219c596c8515… |
rules/assets/text-animations-typewriter.tsx | 100 | 92b5f47d6d18387a… |
rules/assets/text-animations-word-highlight.tsx | 108 | 5dbba688b875baaa… |
rules/audio.md | 172 | 06d859b2f463d0e0… |
rules/calculate-metadata.md | 104 | b258c788fb333718… |
rules/can-decode.md | 75 | fb3f9933e45103d7… |
rules/charts.md | 58 | 2430705a627c468e… |
rules/compositions.md | 146 | 58d92350fecc1cb5… |
rules/display-captions.md | 126 | 96abde72e0bcb88c… |
rules/extract-frames.md | 229 | b7a63f6509a1a33d… |
rules/fonts.md | 152 | 1749e4cf82e8b157… |
rules/get-audio-duration.md | 58 | d5098e8d20b22746… |
rules/get-video-dimensions.md | 68 | 839867aa115e09a7… |
rules/get-video-duration.md | 58 | 7b31fab3cbf9b077… |
rules/gifs.md | 138 | 53d9d658e3093dba… |
rules/images.md | 130 | 91d32f6e528b1f1c… |
rules/import-srt-captions.md | 67 | 38d33be5439714a2… |
rules/lottie.md | 68 | 6c0cb4babcff94e3… |
rules/measuring-dom-nodes.md | 35 | 5270db465cb9eed1… |
rules/measuring-text.md | 143 | 88905cbd701e2473… |
rules/sequencing.md | 106 | ecb74589c87da53d… |
rules/tailwind.md | 11 | bdd5162400cd20c6… |
rules/text-animations.md | 20 | 40ac6b1bccf1c57d… |
rules/timing.md | 179 | f639ed8452767a74… |
rules/transcribe-captions.md | 19 | e7d3edf667e3b1f3… |
rules/transitions.md | 122 | a42100803a1e5e67… |
rules/trimming.md | 53 | 40727aefd5939a42… |
rules/videos.md | 171 | d9d3032a57f92c75… |
skill-card.md | 60 | 2eef236cbbfa4833… |
For agents
JSON: https://agenteconomy.report/k/remotion-best-practices.audit.json · badge: https://agenteconomy.report/k/remotion-best-practices.audited.svg ·
skill rating: /k/remotion-best-practices · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).