Code & Engineering

Remotion Code Review

Reviews pasted Remotion code (React video compositions) for the five mistakes that make a render differ from the preview or come out with missing frames, and lists only those, one line each with a fixed code, the place, why it breaks the render and the fix - or exactly No findings. It catches motion that is not driven by the frame number (CSS transitions and keyframes, timers, requestAnimationFrame, a counter held in state), Math.random in a component instead of the seeded random function, plain img, video, audio and iframe tags that the render does not wait for, data fetched in an effect with no render delay and no calculateMetadata, and a file from the public folder referenced by a bare path instead of staticFile. It leaves out safe look-alikes: clamped interpolate, seeded random, Math.random in a Node script. Use to review a Remotion composition before rendering, to debug flicker or a video that differs between renders, or to gate a pull request that edits a video project.

Remotion Code Review is a tested SKILL.md that reviews pasted Remotion code (React video compositions) for the five mistakes that make a render differ from the preview or come out with missing frames, and lists only those, one line each with a fixed code, the place, why it breaks the render and the fix - or exactly No findings; an agent buys it once for $0.01 over x402.

Tested 2026-10-29No code, no hidden instructionsv1.0.0 · 7.9 KB · perpetual license

Not for

General React review, Remotion settings and render commands, performance of the render, audio mixing and files that are imported but not pasted. It reads pasted Remotion code and judges only what is written in it.

Tested, honestly

Tested 2026-10-29 with a strong and a weak model.

SonnetStrong model, claude-sonnet-5-5
Right on all 3 cases, read by hand. On the stats scene it named the counter advanced by a timer inside an effect and the plain img tag of the chart, and left out the clamped interpolate, the seeded random bars and the Img component with staticFile. On the leaderboard it gave the fetch inside an effect with no render delay and the Audio source written as a bare public path, and left out the Math.random in the Node render script and the fetch inside calculateMetadata. On the clean promo it answered exactly No findings.
HaikuWeak model, claude-haiku-5-5
Right on all 3 cases, read by hand. It gave the same two lines as Sonnet on the stats scene and on the leaderboard, with the same safe look-alikes left out, and answered exactly No findings on the clean promo. One check was wrongly strict and is disclosed: on the leaderboard it suggested calculateMetadata as an alternative fix and named Root.tsx, and the first version of the check rejected any finding line that mentioned Root. The check was narrowed to the intro composition's own fetch and the six saved answers were re-evaluated without a new model call; Haiku's answer is correct.

Full test summary

Example

Our own test text, before and after the skill ran. Excerpts only.

English · claude-sonnet-5-5

Before

import { AbsoluteFill, Img, interpolate, random, staticFile, useCurrentFrame } from 'remotion'; import { useEffect, useState } from 'react'; export const StatsScene: React.FC<{ total: number }> = ({ total }) => { const frame = useCurrentFrame(); const [shown, setShown] = useState(0); useEffect(() => { const id = setInterval(() => setShown((n) => Math.min(n + 7, total)), 40);…

After

MOTION-NOT-FRAME — StatsScene, the `setInterval(() => setShown((n) => Math.min(n + 7, total)), 40)` counter in `useEffect` rendered as `{shown}` — the number advances on a wall-clock timer held in state, so each tab and each frame shows a different value than the frame number implies — compute it from `useCurrentFrame()`, e.g.…

What is in the file

  • The answer
  • The idea behind the codes
  • The codes
  • How to read the code
  • Rules
  • Work in this order
  • Short example

Languages

English. Tried in: English.

License

Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Full terms.

Versions

Current version 1.0.0, updated 2026-10-30. Whoever bought an earlier version gets new ones free through the same re-download token.

  1. v1.0.0 · 2026-10-30

    First release, written in the light-test batch of 29 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from the public Remotion documentation (see notes/ideas.md). Output: one line per finding with a fixed code, or exactly `No findings.`

    Test: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill text after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand. After the runs the frontmatter description was shortened to fit 1,024 characters; the rules the model follows were not changed.

FAQ

Remotion's clamped interpolate: is it reported?

No. A value computed from the frame number with interpolate or spring is the correct way to animate in Remotion, and the clamp option only stops it at the end of its range. The skill lists motion only when it follows a CSS transition, a timer, requestAnimationFrame or a counter kept in state.

Is Math.random always reported?

Only inside a component that is drawn frame by frame. A seeded random call is left alone, and so is Math.random in a Node script that only builds a file name. The reason given is that several threads open the page and get different numbers.

How was it tested?

Three cases, one answer per case from Claude Sonnet and one from Claude Haiku: a stats scene with a timer counter and a plain img tag, a leaderboard that fetches in an effect and hands a bare path to Audio, and a clean promo. The test summary holds the verdicts read by hand.

What does clean code return?

A single fixed sentence, so a pipeline can gate on the text alone; nothing follows it. Otherwise one line per problem: a code, the place, why the render breaks and the Remotion way to write it. Safe patterns never get a line.

Read more

Share

Read this page as Markdown: /skills/remotion-code-review.md.

More in Code & Engineering

  • Postgres or MySQL SQL to SQLite and D1

    Code & Engineering

    SKILL.md · v1.0.2 · 13.9 KB

    Converts PostgreSQL or MySQL schema statements, migrations and queries into SQLite that Cloudflare D1 and Turso run, so the converted version behaves like the original and not only parses. Knows the conversions that run without an error and then go wrong - a key written as BIGSERIAL or INT AUTO_INCREMENT that SQLite stores as NULL, a custom enum type or an inline enum that stops checking anything, a default now() or gen_random_uuid() that SQLite rejects, a unique email that was case-insensitive in MySQL, ON UPDATE CURRENT_TIMESTAMP that needs a trigger, a foreign key added later with ALTER TABLE, a schema prefix, DISTINCT ON, ILIKE, double-colon casts, date_trunc, interval arithmetic, DATEDIFF, GROUP_CONCAT with SEPARATOR, MySQL division that keeps the fraction, ON DUPLICATE KEY UPDATE, JSON operators. Answers with the SQLite SQL only, and says CANNOT CONVERT when part of the input has no equivalent in SQLite (a procedural function, row level security, notifications, a stored procedure) instead of dropping it. Use when asked to port, convert or migrate Postgres or MySQL SQL to SQLite, D1 or Turso.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 9 Oct 2026

  • Flaky Test Review

    Code & Engineering

    SKILL.md · v1.0.0 · 5.7 KB

    Reviews ONE test file for the five causes that make a test pass on one run and fail on the next, and lists only those, one line each with a fixed code, the test, why it flips and the fix - or exactly No findings. It catches a fixed sleep used to wait for background work, an expectation tied to today's date or the current time, tests that share state and only pass in one order, random values with no fixed seed, and a call to a real network address. It leaves out the safe look-alikes, such as a fake clock set before the call, a random generator built from a fixed seed, a mocked network module and fake timers moved by hand. Use to find why a test fails once in a while in CI, to review a new test file before merging, or to harden a suite that people re-run until it goes green.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 26 Oct 2026

  • CSP Header Review

    Code & Engineering

    SKILL.md · v1.0.0 · 6.0 KB

    Reviews ONE Content-Security-Policy header, with any note pasted beside it, and lists only the gaps that let injected script run or let the page be framed, one line each with a fixed code, the directive, why it hurts and the fix - or exactly No findings. It catches unsafe-eval or unsafe-inline in the script directive, a star, a data source or a bare scheme as a script source, a policy with neither object-src nor a default-src, a missing base-uri, a missing frame-ancestors, and a report-only header that the note describes as blocking. It leaves out the safe look-alikes, such as unsafe-inline in style-src only, unsafe-inline beside a nonce, a nonce with strict-dynamic, and a data source for images. Use to review a CSP before rollout, to audit the headers of a site, or to check a policy copied from a tutorial.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 26 Oct 2026

  • Cookie Attributes Review

    Code & Engineering

    SKILL.md · v1.0.0 · 5.9 KB

    Reviews the Set-Cookie headers of a response, or the code that sets them, and lists only the attribute mistakes that expose a login cookie, one line each with a fixed code, the cookie, why it hurts and the fix - or exactly No findings. It catches a session cookie sent without Secure, a session cookie that script can read because HttpOnly is missing, SameSite=None without Secure, a __Host- cookie that carries a Domain or a Path other than the root, a Domain attribute wider than the host that needs the cookie, and a login cookie that lives for months. It leaves out the safe look-alikes, such as a theme or language cookie that script reads, a missing SameSite attribute, and SameSite=None together with Secure. Use to review the cookies of a login flow, to audit a framework's cookie settings, or before a security review of a web app.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 26 Oct 2026