remotion-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: A hardcoded Algolia API key (
3e42dbd4f895fe93ff5cf40d860c4a85) and Application ID are present inremotion-docs/REFERENCE.md. These are search-only credentials used for public documentation discovery. Other sensitive credentials (e.g., AWS, ElevenLabs, Google Maps) are correctly managed via environment variables. - [EXTERNAL_DOWNLOADS]: The skill manages several external dependencies and assets from trusted sources. It fetches documentation from
remotion.dev, loads workers fromunpkg.com, and downloads specialized binaries (Whisper.cpp) via vendor-official packages like@remotion/install-whisper-cpp. - [DYNAMIC_EXECUTION]: In
remotion-markup/remotion-maps/techniques/maplibre/TECHNIQUE.md, the skill usesURL.createObjectURLandBlobto dynamically load and execute MapLibre worker code from a remote CDN (unpkg.com), which is standard for the library's headless operation. - [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing external, untrusted data including SRT subtitles, GeoJSON map paths, and audio metadata. While these represent an ingestion surface for untrusted content, the impact is limited by the frame-based rendering architecture of the Remotion framework.
Audit Metadata