remotion-markup
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the integration of various external services and assets. \n
- Downloads the CesiumJS library from the official Cesium CDN (cesium.com). \n
- References assets and APIs from well-known services including Google Maps, MapTiler, ElevenLabs, and LottieFiles. \n
- Fetches sound effects from the official remotion.media domain. \n
- Suggests a third-party GitHub repository (kapishdima/soundcn) as a resource for additional audio assets. \n- [DYNAMIC_EXECUTION]: The CesiumFlythrough.tsx component dynamically injects a script tag into the document to load the CesiumJS library from a remote CDN at runtime. \n- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for fetching and processing external data (e.g., in calculateMetadata.md and lottie.md) which could potentially introduce untrusted content into the agent's context. \n
- Ingestion points: Data is fetched via fetch() in calculateMetadata and Lottie components. \n
- Boundary markers: None explicitly defined in the provided code snippets to distinguish external data from instructions. \n
- Capability inventory: The skill uses FFmpeg via subprocess calls for video operations. \n
- Sanitization: Standard React/Zod practices are recommended, but no specific instruction-filtering logic is present for raw external text.
Audit Metadata