article-to-video
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which could contain malicious instructions.
- Ingestion points: Pasted text, workspace articles, and attached files as described in the Inputs section of SKILL.md.
- Boundary markers: No explicit delimiters or 'ignore embedded instructions' warnings are used when processing input content.
- Capability inventory: The skill utilizes workspace management, media composition, narration, and rendering tools (SKILL.md).
- Sanitization: No sanitization or filtering of the ingested content is described in the distillation workflow.
- [EXTERNAL_DOWNLOADS]: The skill references official vendor service URLs for setting up the required MCP connector.
- URL: References to https://connect.clueso.io/mcp and https://help.clueso.io/mcp-setup in SKILL.md.
- Context: These links point to the vendor's (Clueso) infrastructure and documentation, representing legitimate functionality for the skill's intended purpose.
- [COMMAND_EXECUTION]: The skill includes instructions for the agent to help the user configure an MCP connector via a command-line interface.
- Evidence:
claude mcp add --transport http Clueso https://connect.clueso.io/mcpis suggested as a command to be offered to users in SKILL.md. - Context: This command allows the agent to integrate with the Clueso service upon user confirmation, which is a standard procedure for MCP-based skills.
Audit Metadata