batch-multi-language-export
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (translated scripts), which presents a potential surface for indirect prompt injection.
- Ingestion points: The skill reads project structures and translated script text in steps 1, 3, and 5.
- Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are provided for handling script content.
- Capability inventory: The skill utilizes Clueso MCP tools to duplicate projects, generate voiceovers, and render video previews.
- Sanitization: No validation or sanitization of the script content is performed before processing.
- [COMMAND_EXECUTION]: The instructions suggest that the agent offer to execute a setup command to register a new MCP connector.
- Evidence: The skill instructs the agent to offer running
claude mcp add --transport http Clueso https://connect.clueso.io/mcpin the "Before you start" section. - Context: This command targets a vendor-controlled resource necessary for the skill's primary functionality.
Audit Metadata