add-key-point-overlays
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires connecting to an external MCP server at
https://connect.clueso.io/mcp. This resource belongs to the skill's author and is used to provide the necessary video editing tools. - [COMMAND_EXECUTION]: The documentation provides a setup command for Claude Code (
claude mcp add --transport http Clueso https://connect.clueso.io/mcp). While this command modifies the agent's environment, it is a standard procedure for adding MCP connectors and points to a verified vendor domain. - [PROMPT_INJECTION]: The skill processes video narration transcripts and rendered frames as inputs. This constitutes an indirect prompt injection surface where untrusted data from a video project could contain malicious instructions.
- Ingestion points: Video narration transcript and rendered frames (SKILL.md).
- Boundary markers: No specific delimiters or warnings are used to isolate transcript content from agent instructions.
- Capability inventory: The skill utilizes video editing, overlay placement, and project export tools via the
clueso-mcpconnector. - Sanitization: The instructions do not describe any filtering or sanitization of the input text before processing.
Audit Metadata