demo-cutdown
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires users to connect to a vendor-owned Model Context Protocol (MCP) server located at
https://connect.clueso.io/mcp. This is a standard architectural requirement for skills utilizing the Clueso ecosystem for video processing tasks. - [COMMAND_EXECUTION]: The documentation provides explicit CLI instructions for different AI environments (e.g.,
claude mcp add) to install the required MCP connector, allowing the agent to interact with Clueso's external editing tools. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and analyzing untrusted content from source recordings.
- Ingestion points: Spoken audio from user-uploaded videos is transcribed and analyzed in Step 2 of the workflow (SKILL.md).
- Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined for the transcription data.
- Capability inventory: The agent can duplicate projects, generate new narration, modify timelines, and export final video files (Steps 5, 6, and 12 in SKILL.md).
- Sanitization: The workflow does not mention sanitization or validation of the transcribed text before it is used to plan the condensed narrative.
Audit Metadata