remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The documentation search instructions in remotion-docs/REFERENCE.md include a hardcoded Algolia API key (3e42dbd4f895fe93ff5cf40d860c4a85). This is a public-facing search key for documentation access.
- [COMMAND_EXECUTION]: The skill provides instructions to run several CLI tools and local scripts, including npx remotion, bunx remotion, and Node.js utility scripts for geospatial data preparation (prep-cesium-path.mjs and prep-geo.mjs).
- [EXTERNAL_DOWNLOADS]: Guidance includes instructions to install packages from standard registries (NPM) and fetch external assets such as fonts from Google, map tiles from Mapbox and MapTiler, and audio from ElevenLabs.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data such as .srt captions and GeoJSON. It includes specific instructions to the agent to preserve user changes and ask for confirmation before overwriting code, which acts as a mitigating control.
Audit Metadata