remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONOBFUSCATION
Full Analysis
- [CREDENTIALS_UNSAFE]: Hardcoded Algolia API key and Application ID are present in
remotion-docs/REFERENCE.md. - These credentials are used to facilitate documentation searches and are public-facing keys identical to those used on the official Remotion documentation site.
- [EXTERNAL_DOWNLOADS]: The skill documentation references and fetches assets from several external domains.
- Fetches library worker scripts from
unpkg.comfor map rendering. - Downloads sound effects and media samples from
remotion.media. - References project templates and documentation on
github.comandremotion.dev. - These resources are standard requirements for the framework's features.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions define surfaces for processing external data during composition rendering.
- Ingestion points: The file
remotion-markup/calculate-metadata.mddemonstrates fetching JSON data from user-provided URLs. - Boundary markers: Explicit delimiters for untrusted data are not present in the provided snippets, as the skill focuses on technical implementation.
- Capability inventory: The skill uses
npxcommands for project management and executes Node.js scripts for data preparation that include file system writes. - Sanitization: Examples rely on standard framework data handling and standard React rendering protections.
- [OBFUSCATION]: Correct and linguistic use of special characters is found in
remotion-markup/arabic-text.md. - The documentation utilizes the Zero-Width Joiner character (
\u200D) as part of a legitimate technique for processing Arabic text to maintain character shaping during animation.
Audit Metadata