highlight-cursor-actions
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches configuration and setup information for the Clueso MCP connector from the official vendor domain (
connect.clueso.io). - [COMMAND_EXECUTION]: The skill provides the agent with instructions to execute a command (
claude mcp add) to install the vendor's MCP server, which enables the core functionality of the skill. - [PROMPT_INJECTION]: The skill processes external inputs that could contain adversarial content, presenting a surface for indirect prompt injection.
- Ingestion points: Narration transcripts and rendered video frames provided by the user or extracted from a project.
- Boundary markers: No specific delimiters or warnings for the agent to ignore instructions embedded in the video or transcript data are defined.
- Capability inventory: The skill is capable of performing video edits and project modifications via the Clueso MCP toolset.
- Sanitization: No explicit sanitization or filtering of the ingested transcript text or frame content is mentioned.
Audit Metadata