recording-to-rfp-response
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to guide the user through installing the Clueso MCP connector using the
claude mcp addcommand. This is a legitimate setup step for the Claude Code platform and includes a manual confirmation step. - [EXTERNAL_DOWNLOADS]: The skill fetches configuration data from
https://connect.clueso.io/mcpto initialize the required Model Context Protocol (MCP) tools. This resource is hosted on the author's official domain. - [PROMPT_INJECTION]: The skill processes external, potentially untrusted RFP requirements provided by the user, which presents an indirect prompt injection attack surface. 1. Ingestion points: The RFP requirements list is ingested as runtime user input during the mapping workflow. 2. Boundary markers: No explicit markers or 'ignore' instructions are defined for the input data in the workflow prompts. 3. Capability inventory: The skill performs video editing, captioning, and article authoring via the Clueso MCP tool. 4. Sanitization: There are no explicit validation or escaping steps mentioned for the ingested requirement text.
Audit Metadata