revoice-video
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the user to manually configure the agent environment by adding an MCP connector using the command
claude mcp add --transport http Clueso https://connect.clueso.io/mcp. This is a standard and transparent setup procedure for the platform. - [EXTERNAL_DOWNLOADS]: The skill references several URLs belonging to the vendor (clueso.io) for connecting the service and accessing help documentation. These references are legitimate and align with the skill's functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data in the form of video transcripts for rewriting. While this presents a surface for indirect prompt injection, the skill specifically mitigates this by requiring a human-in-the-loop approval step: "Show the user the rewritten script (old line → new line, per scene) and get a yes before generating anything."
Audit Metadata