highlight-cursor-actions
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes narration transcripts and video frames to determine editing points, creating an attack surface where adversarial content in the input could influence agent behavior.
-
- Ingestion points: Narration transcripts and video project data (SKILL.md).
-
- Boundary markers: No delimiters or ignore instructions are specified for external content.
-
- Capability inventory: Relies on Clueso MCP for video manipulation.
-
- Sanitization: No sanitization or validation of transcript text is described.
- [COMMAND_EXECUTION]: The skill documents how to add the Clueso MCP connector using platform-specific commands, such as
claude mcp add --transport http Clueso https://connect.clueso.io/mcp. These instructions target official vendor infrastructure and are part of the intended setup process.
Audit Metadata