remotion-docs
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill contains a hardcoded Algolia API key (
3e42dbd4f895fe93ff5cf40d860c4a85) and Application ID (PLSDUOL1CA) inSKILL.mdto facilitate documentation search. While this is a public search key, hardcoding credentials in instruction sets is a poor security practice. - [EXTERNAL_DOWNLOADS]: The skill fetches documentation content from the vendor's domain (
remotion.dev) and performs search queries via Algolia (algolia.net). These are recognized as legitimate service and vendor resources. - [INDIRECT_PROMPT_INJECTION]: The skill fetches external Markdown documentation which is then processed as instructions for the agent's implementation workflow.
- Ingestion points: Documentation page URLs identified via search results in
SKILL.md. - Boundary markers: Absent; the instructions do not define delimiters or specific safety wrappers for the fetched external content.
- Capability inventory: Network operations via HTTPS (GET and POST).
- Sanitization: None; the agent is instructed to use the documentation content directly for implementation guidance.
Audit Metadata