remotion-best-practices

Warn

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The remotion-docs/REFERENCE.md file contains a hardcoded Algolia API key (3e42dbd4f895fe93ff5cf40d860c4a85) and Application ID (PLSDUOL1CA) used for documentation search. While documentation search keys are often intended for public use, its presence in the instruction set constitutes an exposure of static credentials.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill ingests data from user-provided URLs through calculateMetadata functions in remotion-markup/calculate-metadata.md and media inspection tools in remotion-multimedia/REFERENCE.md.
  • Boundary markers: The skill does not provide instructions to wrap this external content in delimiters or use warnings to ignore instructions embedded in those external sources.
  • Capability inventory: The skill is capable of network operations via fetch and arbitrary command execution using Remotion CLI tools (npx remotion).
  • Sanitization: No sanitization or validation of the fetched data or input URLs is present in the examples provided to the agent.
  • [EXTERNAL_DOWNLOADS]: The skill fetches assets and libraries from official domains of recognized service providers, including cesium.com, maptiler.com, mapbox.com, and googleapis.com. These are documented neutrally as they originate from well-known technology organizations.
  • [COMMAND_EXECUTION]: The instructions direct the agent to execute a variety of CLI commands using npx, bunx, and npm, primarily for running Remotion Studio, rendering videos, and managing project upgrades.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 22, 2026, 08:22 PM