remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Oct 20, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The file remotion-docs/REFERENCE.md contains a hardcoded Algolia search API key (3e42dbd4f895fe93ff5cf40d860c4a85). This is a public search-only key used specifically for documentation discovery on the Remotion website and is standard for DocSearch integrations.
  • [EXTERNAL_DOWNLOADS]: The skill references and downloads dependencies from official and well-known registries:
  • Multiple guides recommend installing @remotion/* packages and other utilities like maplibre-gl, mapbox-gl, and @turf/turf from the official npm registry.
  • remotion-markup/remotion-maps/techniques/cesium/assets/CesiumFlythrough.tsx fetches the CesiumJS library from its official CDN at cesium.com at runtime.
  • [COMMAND_EXECUTION]: The skill includes instructions and scripts for developers to prepare their environment:
  • remotion-markup/remotion-maps/techniques/cesium/scripts/prep-cesium-path.mjs and remotion-markup/remotion-maps/techniques/maptiler/scripts/prep-geo.mjs are utility scripts provided for users to process geographic data locally using the fs module.
  • remotion-captions/transcribe-captions.md describes a setup process involving the installation of Whisper.cpp and downloading AI models.
  • [DYNAMIC_EXECUTION]: The technique guide for MapLibre involves generating a worker URL using URL.createObjectURL and a Blob containing an import statement for a remote script, which is a standard pattern for initializing web workers in mapping libraries.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes functionality that involves fetching external data:
  • Ingestion points: calculate-metadata.md and voiceover.md document the use of fetch() to retrieve metadata or audio assets from user-provided URLs (props.dataUrl).
  • Boundary markers: Not present in the suggested implementation snippets.
  • Capability inventory: The framework uses fetch for network operations and provides scripts with fs access for local data preparation.
  • Sanitization: Standard React rendering is used for text, but the skill does not explicitly detail sanitization for instructions embedded in data; this is considered standard for the framework's primary use-case of data-driven video generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 20, 2026, 06:45 AM