polish-screen-demo

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to assist the user in setting up the Clueso connection by running commands such as claude mcp add --transport http Clueso https://connect.clueso.io/mcp or codex plugin add app-6a310833394081919705b0a3ee745267@openai-curated-remote. These are targeted at installing the vendor's own required components.
  • [EXTERNAL_DOWNLOADS]: The skill references the Clueso MCP endpoint (https://connect.clueso.io/mcp) and various documentation links on the clueso.io domain for setup and authentication.
  • [INDIRECT_PROMPT_INJECTION]: The workflow involves transcribing audio from user-uploaded recordings to determine step boundaries and narration.
  • Ingestion points: User-uploaded raw screen recordings and audio tracks within the SKILL.md workflow.
  • Boundary markers: No specific delimiters or warnings are mentioned for handling the output of the transcription process.
  • Capability inventory: The skill performs file and project manipulations (split, trim, zoom, highlight) and generates network-accessible export links using the clueso-mcp toolset.
  • Sanitization: There is no evidence of sanitization or filtering for potentially malicious instructions embedded in transcribed audio content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 06:27 AM