remotion-dev/skills remotion-best-practices
Checked the catalogued skill at remotion-best-practices.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
F; retained sample includes a critical finding · SD-006 · what this rule accepts as a false positive →
A set by no findings on this axis
14 suppressed by AI triage
fetch(staticFile("subtitles.srt")) loads a local file, not an outbound network request.
The content is documentation describing use of fetch(), not an actual outbound network call.
The accessToken is referenced through a variable (mapboxAccessToken), not a literal string, so no hardcoded secret is present.
The accessToken is referenced through a variable (mapboxAccessToken), not a literal string, so no hardcoded secret is present.
The path traversal references bundled internal assets within the skill package, not arbitrary system directories.
The detected "../" is part of a documentation link, not executable code, so it does not pose a threat.
The path traversal occurs only in a Markdown link, not in executable code.
The code snippet is a documentation example fetching a public animation asset from a known CDN, not a malicious outbound exfiltration.
The accessToken is referenced through a variable (mapboxAccessToken), not a literal string, so no hardcoded secret is present.
The accessToken is referenced through a variable (mapboxAccessToken), not a literal string, so no hardcoded secret is present.
The path traversal references bundled internal assets within the skill package, not arbitrary system directories.
The matched text is a comment about best practices, not an actual path traversal pattern.
The link is a relative markdown reference in documentation, not code that could traverse the file system.
The snippet is documentation of a normal outbound API call, not malicious code