remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The file remotion-docs/REFERENCE.md contains a hardcoded Algolia API key (3e42dbd4f895fe93ff5cf40d860c4a85) and Application ID (PLSDUOL1CA). These are public credentials intended to enable the agent to query the Remotion documentation index.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates data and asset loading from several well-known and reputable services:
  • Retrieves 3D tiles and map data from tile.googleapis.com (Google) and api.maptiler.com (MapTiler).
  • Loads the CesiumJS mapping engine from the official Cesium CDN (cesium.com).
  • References additional sound effect resources located on GitHub (github.com/kapishdima/soundcn).
  • [REMOTE_CODE_EXECUTION]: The component remotion-maps/techniques/cesium/assets/CesiumFlythrough.tsx dynamically loads and executes the CesiumJS library from a remote URL. This is a standard integration pattern for including this mapping library in a web-based video rendering pipeline.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a documentation lookup workflow (remotion-docs/REFERENCE.md) that ingests third-party content into the agent context.
  • Ingestion points: Markdown content retrieved from documentation search results (remotion.dev).
  • Boundary markers: None explicitly defined in the provided instruction files.
  • Capability inventory: The skill can execute shell commands via npx remotion and perform network operations via fetch based on the fetched information.
  • Sanitization: Content is fetched and injected directly into the prompt without filtering.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:24 PM