remotion-maps
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses MapLibre GL JS which, in its standard implementation, fetches worker scripts from
unpkg.com. It also references CesiumJS assets being loaded from a CDN. These are standard operations for these mapping libraries. - [DATA_EXPOSURE]: The instructions require the use of API keys for MapTiler, Google Maps, and Mapbox. The skill correctly advises the user to provide these via environment variables (e.g.,
REMOTION_MAPBOX_TOKEN,REMOTION_MAPTILER_KEY) rather than hardcoding secrets, which is a secure practice. - [COMMAND_EXECUTION]: The skill includes utility scripts (
prep-cesium-path.mjs,prep-geo.mjs) intended for processing geographic data (GeoJSON). these scripts perform standard file system operations (fs.readFileSync,fs.writeFileSync) to transform raw spatial data into optimized formats for animation. These are legitimate developer tools. - [DYNAMIC_EXECUTION]: The MapLibre example uses
URL.createObjectURLwith aBlobto initialize a Web Worker. This is a common and legitimate pattern for loading the MapLibre worker in browser environments where local file access might be restricted.
Audit Metadata