remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
remotion-docs/REFERENCE.mdcontains a hardcoded Algolia search API key (3e42dbd4f895fe93ff5cf40d860c4a85). This is a public search-only key used specifically for documentation discovery on the Remotion website and is standard for DocSearch integrations. - [EXTERNAL_DOWNLOADS]: The skill references and downloads dependencies from official and well-known registries:
- Multiple guides recommend installing
@remotion/*packages and other utilities likemaplibre-gl,mapbox-gl, and@turf/turffrom the official npm registry. remotion-markup/remotion-maps/techniques/cesium/assets/CesiumFlythrough.tsxfetches the CesiumJS library from its official CDN atcesium.comat runtime.- [COMMAND_EXECUTION]: The skill includes instructions and scripts for developers to prepare their environment:
remotion-markup/remotion-maps/techniques/cesium/scripts/prep-cesium-path.mjsandremotion-markup/remotion-maps/techniques/maptiler/scripts/prep-geo.mjsare utility scripts provided for users to process geographic data locally using thefsmodule.remotion-captions/transcribe-captions.mddescribes a setup process involving the installation of Whisper.cpp and downloading AI models.- [DYNAMIC_EXECUTION]: The technique guide for MapLibre involves generating a worker URL using
URL.createObjectURLand aBlobcontaining an import statement for a remote script, which is a standard pattern for initializing web workers in mapping libraries. - [INDIRECT_PROMPT_INJECTION]: The skill describes functionality that involves fetching external data:
- Ingestion points:
calculate-metadata.mdandvoiceover.mddocument the use offetch()to retrieve metadata or audio assets from user-provided URLs (props.dataUrl). - Boundary markers: Not present in the suggested implementation snippets.
- Capability inventory: The framework uses
fetchfor network operations and provides scripts withfsaccess for local data preparation. - Sanitization: Standard React rendering is used for text, but the skill does not explicitly detail sanitization for instructions embedded in data; this is considered standard for the framework's primary use-case of data-driven video generation.
Audit Metadata