remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
remotion-docs/REFERENCE.mdcontains a hardcoded Algolia API key (3e42dbd4f895fe93ff5cf40d860c4a85) and Application ID (PLSDUOL1CA). These are public credentials intended to enable the agent to query the Remotion documentation index. - [EXTERNAL_DOWNLOADS]: The skill facilitates data and asset loading from several well-known and reputable services:
- Retrieves 3D tiles and map data from
tile.googleapis.com(Google) andapi.maptiler.com(MapTiler). - Loads the CesiumJS mapping engine from the official Cesium CDN (
cesium.com). - References additional sound effect resources located on GitHub (
github.com/kapishdima/soundcn). - [REMOTE_CODE_EXECUTION]: The component
remotion-maps/techniques/cesium/assets/CesiumFlythrough.tsxdynamically loads and executes the CesiumJS library from a remote URL. This is a standard integration pattern for including this mapping library in a web-based video rendering pipeline. - [INDIRECT_PROMPT_INJECTION]: The skill implements a documentation lookup workflow (
remotion-docs/REFERENCE.md) that ingests third-party content into the agent context. - Ingestion points: Markdown content retrieved from documentation search results (remotion.dev).
- Boundary markers: None explicitly defined in the provided instruction files.
- Capability inventory: The skill can execute shell commands via
npx remotionand perform network operations viafetchbased on the fetched information. - Sanitization: Content is fetched and injected directly into the prompt without filtering.
Audit Metadata