remotion-best-practices

Pass

Audited by Gen Agent Trust Hub on Nov 8, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONOBFUSCATION
Full Analysis
  • [CREDENTIALS_UNSAFE]: Hardcoded Algolia API key and Application ID are present in remotion-docs/REFERENCE.md.
  • These credentials are used to facilitate documentation searches and are public-facing keys identical to those used on the official Remotion documentation site.
  • [EXTERNAL_DOWNLOADS]: The skill documentation references and fetches assets from several external domains.
  • Fetches library worker scripts from unpkg.com for map rendering.
  • Downloads sound effects and media samples from remotion.media.
  • References project templates and documentation on github.com and remotion.dev.
  • These resources are standard requirements for the framework's features.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructions define surfaces for processing external data during composition rendering.
  • Ingestion points: The file remotion-markup/calculate-metadata.md demonstrates fetching JSON data from user-provided URLs.
  • Boundary markers: Explicit delimiters for untrusted data are not present in the provided snippets, as the skill focuses on technical implementation.
  • Capability inventory: The skill uses npx commands for project management and executes Node.js scripts for data preparation that include file system writes.
  • Sanitization: Examples rely on standard framework data handling and standard React rendering protections.
  • [OBFUSCATION]: Correct and linguistic use of special characters is found in remotion-markup/arabic-text.md.
  • The documentation utilizes the Zero-Width Joiner character (\u200D) as part of a legitimate technique for processing Arabic text to maintain character shaping during animation.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 8, 2026, 06:25 PM