add-callouts-and-arrows
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes narration transcripts to determine timestamps and targets for visual annotations. This process creates an ingestion point where malicious instructions embedded in a video's narration or transcript could potentially influence the agent's behavior.\n
- Ingestion points: Narration transcripts provided by the user or extracted from videos (Workflow Step 1).\n
- Boundary markers: None identified in the workflow instructions.\n
- Capability inventory: The skill uses
clueso-mcpto inspect frames, determine coordinates, and place callouts/arrows (Workflow Steps 1-3).\n - Sanitization: There are no explicit steps for sanitizing or validating the content of the narration transcripts before processing.\n- [EXTERNAL_DOWNLOADS]: The skill includes instructions to install and connect the Clueso MCP server and related plugins from external sources.\n
- Evidence: Instructions mention running
claude mcp add --transport http Clueso https://connect.clueso.io/mcpand installing the Clueso plugin for Codex fromopenai-curated-remote. These resources originate from the vendor's official infrastructure or well-known service registries.
Audit Metadata