explain-it-simply

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (explainer topics) to generate scripts and video content.\n
  • Ingestion points: SKILL.md defines inputs as a "topic or question to explain" provided by the user.\n
  • Boundary markers: Absent. There are no instructions to use delimiters or ignore instructions embedded within the user's topic description.\n
  • Capability inventory: The skill uses clueso-mcp tools to create projects, add clips, generate narration, and export videos.\n
  • Sanitization: Absent. The skill does not describe any validation or filtering of the user-provided topic before script generation.\n- [EXTERNAL_DOWNLOADS]: The skill references an external Model Context Protocol (MCP) server for tool access.\n
  • Fetches configuration and transport logic from https://connect.clueso.io/mcp.\n
  • This is a vendor-owned resource used to enable the skill's primary functionality.\n- [COMMAND_EXECUTION]: The skill may attempt to execute a configuration command with user approval.\n
  • In Claude Code environments, the agent is instructed to offer to run claude mcp add --transport http Clueso https://connect.clueso.io/mcp.\n
  • This command modifies the agent's execution environment by adding a new tool connector.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 06:27 AM