add-logo-watermark
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external media provided by the user, creating a surface where malicious instructions could be embedded in file content or metadata. Ingestion points: User-provided video files, screen recordings, and logo images. Boundary markers: No specific delimiters or safety instructions are defined to separate untrusted media data from agent instructions. Capability inventory: The skill utilizes the Clueso MCP for video editing and project management. Sanitization: The instructions do not specify validation or sanitization for imported media.
- [EXTERNAL_DOWNLOADS]: The skill provides the user with commands to connect to an external Model Context Protocol (MCP) server. Evidence: The skill instructs the user to run
claude mcp add --transport http Clueso https://connect.clueso.io/mcp. Context: These resources are hosted on the vendor's official domain and represent standard setup for the skill's functionality.
Audit Metadata