remotion-maps
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE]: The skill uses environment variables (REMOTION_MAPTILER_KEY, REMOTION_GOOGLE_MAPS_API_KEY, REMOTION_MAPBOX_TOKEN) to manage API keys for mapping services. No hardcoded secrets were detected.
- [REMOTE_CODE_EXECUTION]: The CesiumFlythrough component dynamically loads the CesiumJS library from an official CDN (cesium.com). Additionally, MapLibre and Mapbox techniques use worker scripts loaded from unpkg.com. These are standard practices for these mapping engines to function in a browser-based environment like Remotion.
- [COMMAND_EXECUTION]: Includes utility scripts (prep-cesium-path.mjs, prep-geo.mjs) for processing geospatial data. These scripts perform local file operations (reading/writing GeoJSON) and coordinate mathematics using the @turf/turf library. They do not attempt to access sensitive system files or execute arbitrary shell commands.
- [EXTERNAL_DOWNLOADS]: The skill fetches map tiles, terrain data, and style configurations from well-known technology providers, including MapTiler, Mapbox, Google Maps, and MapLibre. All network operations are tied to the primary purpose of map rendering.
- [DYNAMIC_EXECUTION]: Uses dynamic script injection and Blob URLs for Web Workers to initialize complex WebGL-based mapping engines. This is a routine implementation for modern mapping libraries.
Audit Metadata