remove-filler-words
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes video transcripts from user-provided recordings or existing projects, which represents an attack surface for indirect prompt injection. 1. Ingestion points: Video transcripts are read in the workflow (Workflow step 2 in SKILL.md). 2. Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within transcripts. 3. Capability inventory: The skill utilizes Clueso MCP tools for script regeneration, audio processing, and video exporting. 4. Sanitization: There is no mention of sanitization or validation for the ingested transcript content.
- [REMOTE_CODE_EXECUTION]: The skill provides instructions for the agent to connect a remote MCP server from the vendor's domain.
- Evidence: Instructions for
claude mcp add --transport http Clueso https://connect.clueso.io/mcpare included to facilitate the video editing workflow. This targets the vendor's official infrastructure.
Audit Metadata