remotion-maps

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the CesiumJS library from its official CDN (cesium.com) and retrieves map tiles, terrain, and satellite imagery from well-known providers including Google Maps, MapTiler, and Mapbox.
  • [EXTERNAL_DOWNLOADS]: The skill references OpenStreetMap data through public Overpass API mirrors (overpass-api.de and overpass.kumi.systems) to fetch geographic centerlines for path preparation.
  • [DYNAMIC_EXECUTION]: The CesiumFlythrough component dynamically injects a script tag to load the CesiumJS library at runtime. Additionally, the MapLibre and Mapbox techniques use URL.createObjectURL to initialize WebGL workers from script blobs, which are standard implementation patterns for these geospatial libraries.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests geographic data in GeoJSON and JSON formats from local assets and external OpenStreetMap APIs. While this creates a theoretical ingestion surface for untrusted data, the impact is confined to the visual rendering of the map animation and does not interact with higher-privilege system operations.
  • Ingestion points: Geographic data loaded from assets/*.json and fetched from Overpass API mirrors.
  • Boundary markers: None (standard for geographic data formats).
  • Capability inventory: Browser-based WebGL rendering and local data preparation via Node.js scripts.
  • Sanitization: Input is parsed through standard JSON parsers and validated via Turf.js geospatial operations.
  • [COMMAND_EXECUTION]: The skill includes utility scripts (prep-cesium-path.mjs, prep-geo.mjs) intended for local use by the developer to process geographic data. These scripts use standard file system operations (fs) to read GeoJSON and write processed JSON paths.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 07:51 AM