academy-course-trailer
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user on how to manually connect the Clueso Model Context Protocol (MCP) using a CLI command:
claude mcp add --transport http Clueso https://connect.clueso.io/mcp. This is presented as a setup instruction requiring user confirmation and targets the vendor's official domain. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided content, such as course syllabi and product descriptions, to generate video scripts and narration.
- Ingestion points: Course names, syllabus/module lists, and outcome promises collected from the user during the input phase in
SKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the course data are defined.
- Capability inventory: The skill uses Clueso MCP tools to draft scripts, compose motion scenes, and export video files.
- Sanitization: No specific sanitization or validation logic for user-provided text is described.
Audit Metadata