demo-trimmed-for-one-buyer
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by transcribing spoken audio from user-provided video files to map the demo's structure. This creates a potential surface where malicious instructions embedded in the audio could influence agent behavior. Ingestion points: Spoken audio transcripts from demo videos. Boundary markers: None identified. Capability inventory: Project duplication, segment removal, audio regeneration, and video export. Sanitization: None identified.
- [COMMAND_EXECUTION]: The skill provides instructions for the user to configure the Clueso MCP connector using shell commands such as
claude mcp add. This is a legitimate setup procedure for the required service. - [EXTERNAL_DOWNLOADS]: The skill references official vendor domains (
clueso.io) and specific plugin identifiers for environment configuration, which is consistent with the skill's purpose.
Audit Metadata