brief-to-launch-video
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided inputs to generate voiceover scripts and scene descriptions, creating a surface for indirect prompt injection.
- Ingestion points: The skill ingests 'Product name', 'Audience', 'Key points', and 'Call to action' from the user.
- Boundary markers: The instructions do not define specific delimiters or 'ignore' instructions for the interpolated user data.
- Capability inventory: The skill utilizes Clueso MCP tools for workspace management, project creation, scene composition, voiceover generation, and video exporting.
- Sanitization: The risk is significantly mitigated by a mandatory workflow step requiring the agent to show the draft script to the user and receive approval before any video construction begins.
- [COMMAND_EXECUTION]: The skill instructs the agent to offer to execute configuration commands for the Clueso MCP connector.
- Evidence: In SKILL.md, the agent is instructed to offer the command 'claude mcp add --transport http Clueso https://connect.clueso.io/mcp' to the user.
- Context: The command targets the vendor's own official connection endpoint and includes a requirement for explicit user confirmation before execution, which is a standard and safe setup procedure.
Audit Metadata