add-cta-end-card
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The instructions include the command
claude mcp add --transport http Clueso https://connect.clueso.io/mcp. This is a standard setup command used to register the Clueso Model Context Protocol (MCP) server with the assistant, enabling the skill's video editing capabilities. - [EXTERNAL_DOWNLOADS]: The skill references connection endpoints and documentation at
connect.clueso.ioandhelp.clueso.io. These domains are official resources provided by the vendor for tool integration and user support. - [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection as it processes user-provided content.
- Ingestion points: CTA text, action links, and video project identifiers specified by the user in SKILL.md.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are included for the user-provided CTA text.
- Capability inventory: The skill uses Clueso MCP tools to modify video scenes and generate text overlays.
- Sanitization: No explicit input validation or escaping mechanisms are defined within the skill's instructional flow.
Audit Metadata