compliance-training-localization
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to configure the Clueso MCP connector using the endpoint
https://connect.clueso.io/mcp. This is a vendor-owned resource (clueso.io) belonging to the skill author and is necessary for the skill's functionality. - [COMMAND_EXECUTION]: The instructions include a specific shell command for Claude Code users:
claude mcp add --transport http Clueso https://connect.clueso.io/mcp. This command integrates the vendor's toolset into the agent's environment with the user's confirmation. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes external content provided by the user.
- Ingestion points: The skill ingests user-provided video narration (via transcription), scripts, and compliance glossaries.
- Boundary markers: No specific delimiters or safety instructions are defined to separate untrusted data from processing instructions.
- Capability inventory: The skill uses the Clueso MCP to duplicate projects, generate audio, re-sync visuals, render previews, and export videos.
- Sanitization: The skill relies on the agent's internal translation logic and glossary enforcement; no explicit sanitization or filtering of external input is described.
Audit Metadata