Skills remotion-markup

📦

remotion-markup

Name: remotion-markup
Author: remotion-dev

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Build polished Remotion video markup

Building video compositions can require many React, timing, and media decisions. This skill provides focused Remotion patterns for creating maintainable video markup.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "remotion-markup" from https://skillstore.io/skills/remotion-dev-remotion-markup.md and its manifest at https://skillstore.io/api/skills/remotion-dev-remotion-markup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/remotion-dev-remotion-markup.md Signed manifest GET /api/skills/remotion-dev-remotion-markup/manifest Signed lockfile GET /api/skills/remotion-dev-remotion-markup/lockfile

Test it

Using "remotion-markup". Create a title card that appears during the first second.

Expected outcome:

A composition outline with a full-frame title card.
Frame-based opacity and scale timing guidance.
Suggested accessibility and layout checks.

Using "remotion-markup". Make my composition match the duration of an audio file.

Expected outcome:

A calculateMetadata approach for measuring audio duration.
A frame-duration calculation using the selected FPS.
A note to validate asset locations before rendering.

Using "remotion-markup". Add a MapLibre map background.

Expected outcome:

A map composition structure using a reviewed style source.
Guidance for deterministic map rendering.
Notes about network access and asset ownership.

Security Audit

High Risk

v1 • 7/20/2026 Open versioned report

Most static detections are false positives caused by Markdown fences, JavaScript template literals, relative documentation links, and public example URLs. One example fetches an unvalidated caller-provided URL, which can enable server-side request forgery in server rendering contexts. The voiceover example also constructs an output path from unvalidated identifiers.

Files scanned

4,145

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

voiceover.md:26 voiceover.md:53

Unvalidated identifiers in generated audio path

The voiceover example writes a file path built from compositionId and scene.id without showing validation. If those values are untrusted, path segments can escape the intended public/voiceover directory and overwrite files available to the process.

The documentation explicitly states that the script reads scene config and then interpolates two identifiers into writeFileSync. Exploitability depends on whether callers control those identifiers, but no path normalization or allowlist is shown.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

calculate-metadata.md:112

Fetch API call

const response = await fetch(props.dataUrl, { signal: abortSignal });

The example fetches the caller-controlled props.dataUrl without validation. In a server-side render workflow, an untrusted URL could reach internal network services.

Risk Factors

⚙️ External commands (50)

🌐 Network access (25)

📁 Filesystem access (9)

calculate-metadata.md:29 calculate-metadata.md:48 silence-detection.md:19 silence-detection.md:31 SKILL.md:9 SKILL.md:193 text-highlights.md:56 voiceover.md:53 voiceover.md:58

🔑 Env variables (10)

mapbox.md:59 mapbox.md:76 mapbox.md:152 mapbox.md:59 mapbox.md:76 mapbox.md:152 voiceover.md:36 voiceover.md:36 voiceover.md:14 voiceover.md:36

Audited by: claude

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/remotion-dev-remotion-markup/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/remotion-dev-remotion-markup/security.svg)](https://skillstore.io/skills/remotion-dev-remotion-markup?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/remotion-dev-remotion-markup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/remotion-dev-remotion-markup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/remotion-dev-remotion-markup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

remotion-dev. (2026). remotion-markup security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/remotion-dev-remotion-markup/audits/1

BibTeX citation

@techreport{remotion-dev-remotion-dev-remotion-markup-2026,
  author = {remotion-dev},
  title = {remotion-markup security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/remotion-dev-remotion-markup/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "remotion-markup security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "remotion-dev"
date-released: "2026-07-20"
url: "https://skillstore.io/skills/remotion-dev-remotion-markup/audits/1"
identifiers:
  - type: other
    value: "skillstore:remotion-dev-remotion-markup:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a product video

Build a React composition with animated text, images, audio, and scene timing.

Edit a video timeline

Trim clips, sequence scenes, and calculate duration for a multi-part composition.

Add narrated explainers

Generate scene audio with an approved TTS provider and match composition length to audio.

Try These Prompts

Start a composition

Create a simple Remotion composition with a title, background color, and fade-in animation.

Add media assets

Add an image sequence and background audio to my Remotion composition. Use local public assets and explain the timing.

Build a scene timeline

Help me sequence three video scenes with trims, overlaps, and a transition at 30 frames per second.

Design dynamic metadata

Design a calculateMetadata function for my Remotion composition. Validate external URLs and keep all fetched data within approved limits.

Best Practices

Use local or approved media assets when rendering production videos.
Keep timing calculations in frames and define the composition FPS clearly.
Validate external URLs and dynamic asset identifiers before server-side rendering.

Avoid

Do not place unvalidated user identifiers directly into output file paths.
Do not fetch arbitrary user-provided URLs from a rendering server.
Do not depend on remote media without considering availability, licensing, and caching.