explain-it-simply
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (explainer topics) to generate scripts and video content.\n
- Ingestion points: SKILL.md defines inputs as a "topic or question to explain" provided by the user.\n
- Boundary markers: Absent. There are no instructions to use delimiters or ignore instructions embedded within the user's topic description.\n
- Capability inventory: The skill uses
clueso-mcptools to create projects, add clips, generate narration, and export videos.\n - Sanitization: Absent. The skill does not describe any validation or filtering of the user-provided topic before script generation.\n- [EXTERNAL_DOWNLOADS]: The skill references an external Model Context Protocol (MCP) server for tool access.\n
- Fetches configuration and transport logic from
https://connect.clueso.io/mcp.\n - This is a vendor-owned resource used to enable the skill's primary functionality.\n- [COMMAND_EXECUTION]: The skill may attempt to execute a configuration command with user approval.\n
- In Claude Code environments, the agent is instructed to offer to run
claude mcp add --transport http Clueso https://connect.clueso.io/mcp.\n - This command modifies the agent's execution environment by adding a new tool connector.
Audit Metadata