remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
remotion-docs/REFERENCE.mdcontains a hardcoded Algolia API key and Application ID. This is a public search-only key used to query the framework's official documentation and is not considered a sensitive secret. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent and user to fetch assets, documentation, and dependencies from trusted domains and well-known services, including
remotion.dev,remotion.media,google.com,mapbox.com,maptiler.com, and official GitHub repositories. - [COMMAND_EXECUTION]: The instructions include various
npx remotionandnpm installcommands for project scaffolding, rendering, upgrading, and adding framework modules. These are standard operations for the Remotion development environment. - [INDIRECT_PROMPT_INJECTION]: The documentation search workflow in
remotion-docs/REFERENCE.mdinvolves fetching and processing external markdown content. This represents a vulnerability surface where remote content could influence agent behavior, though the sources are author-controlled. - [DYNAMIC_EXECUTION]: Documentation for MapLibre integration in
remotion-maps/techniques/maplibre/TECHNIQUE.mdincludes an example of loading worker scripts via blob URLs from theunpkg.comCDN, which is a standard library implementation pattern.
Audit Metadata