remotion-maps
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches map tiles, terrain data, and 3D architectural meshes from well-known and trusted services, including Google Maps (tile.googleapis.com), MapTiler (api.maptiler.com), and Mapbox. These network operations are intrinsic to the skill's primary purpose of map animation.
- [DYNAMIC_EXECUTION]: In
techniques/cesium/assets/CesiumFlythrough.tsx, the skill dynamically loads the CesiumJS library at runtime by injecting a script tag pointing to the official Cesium CDN (cesium.com). This is a standard integration pattern for including high-performance 3D rendering engines in web applications. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests geospatial coordinates (GeoJSON) and path data provided by users to drive camera movements and line animations.
- Ingestion points: Path properties in
CesiumFlythrough.tsxand coordinate data inRiverReveal.tsx. - Boundary markers: None explicitly present to validate coordinate formats, though the data is processed numerically.
- Capability inventory: The skill has the capability to inject script tags into the DOM and perform complex WebGL rendering.
- Sanitization: External data is processed via mathematical formulas (Haversine distance, bearing) and industry-standard geospatial libraries like Turf.js, which helps mitigate against non-numeric injection payloads.
Audit Metadata