remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
remotion-docs/REFERENCE.mdcontains a hardcoded Algolia API key (3e42dbd4f895fe93ff5cf40d860c4a85) used for the documentation search functionality. This is a public search-only key for the service's official documentation index. - [EXTERNAL_DOWNLOADS]: The skill dynamically loads the CesiumJS library from a public CDN (
cesium.com) inremotion-markup/remotion-maps/techniques/cesium/assets/CesiumFlythrough.tsx. Cesium is a well-known service for 3D geospatial visualization. - [INDIRECT_PROMPT_INJECTION]: The
remotion-docsskill includes a workflow that fetches documentation content from theremotion.devwebsite to guide code implementation. This presents a potential surface for indirect prompt injection if the source documentation were to be compromised, as the agent processes the retrieved text without explicit boundary markers or sanitization to ignore embedded instructions.
Audit Metadata