remotion-best-practices
Warn
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The
remotion-docs/REFERENCE.mdfile contains a hardcoded Algolia API key (3e42dbd4f895fe93ff5cf40d860c4a85) and Application ID (PLSDUOL1CA) used for documentation search. While documentation search keys are often intended for public use, its presence in the instruction set constitutes an exposure of static credentials. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests data from user-provided URLs through
calculateMetadatafunctions inremotion-markup/calculate-metadata.mdand media inspection tools inremotion-multimedia/REFERENCE.md. - Boundary markers: The skill does not provide instructions to wrap this external content in delimiters or use warnings to ignore instructions embedded in those external sources.
- Capability inventory: The skill is capable of network operations via
fetchand arbitrary command execution using Remotion CLI tools (npx remotion). - Sanitization: No sanitization or validation of the fetched data or input URLs is present in the examples provided to the agent.
- [EXTERNAL_DOWNLOADS]: The skill fetches assets and libraries from official domains of recognized service providers, including
cesium.com,maptiler.com,mapbox.com, andgoogleapis.com. These are documented neutrally as they originate from well-known technology organizations. - [COMMAND_EXECUTION]: The instructions direct the agent to execute a variety of CLI commands using
npx,bunx, andnpm, primarily for running Remotion Studio, rendering videos, and managing project upgrades.
Audit Metadata