feature-release-video
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides the command
claude mcp add --transport http Clueso https://connect.clueso.io/mcpto allow users to integrate the Clueso service. This is a standard setup procedure for using MCP-based tools within the Claude Code environment. - [EXTERNAL_DOWNLOADS]: The skill references several setup URLs and a plugin link for the Clueso service (e.g.,
https://connect.clueso.io/mcp,https://help.clueso.io/mcp-setup). These resources originate from the vendor's infrastructure and are necessary for the skill to operate. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data such as release notes, changelogs, and PRD blurbs to generate video scripts and demo content.
- Ingestion points: User-provided release material and changelog text described in the Inputs section of SKILL.md.
- Boundary markers: None explicitly specified to delineate the untrusted content.
- Capability inventory: Uses the Clueso MCP tools to generate and edit video projects.
- Sanitization: No specific input sanitization or validation logic is defined.
Audit Metadata