screenshots-to-walkthrough
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads cursor image assets (e.g.,
default-cursor.png) from the vendor's asset server atpublicassets.in.prod.clueso.ioto be used in the generated video. - [COMMAND_EXECUTION]: The skill provides the agent with specific commands to assist the user in setting up the Clueso MCP connector (e.g.,
claude mcp add --transport http Clueso https://connect.clueso.io/mcp). These are standard setup procedures for this service and are intended to be executed with user confirmation. - [INDIRECT_PROMPT_INJECTION]: The skill can process screenshots hosted at public URLs provided by the user. This creates a potential surface where text or instructions embedded within the images could be interpreted by the agent, although this capability is central to the skill's purpose.
- Ingestion points: Workflow Step 1 (screenshots from public URLs).
- Boundary markers: None explicitly defined for image content analysis.
- Capability inventory: Project management, asset handling, and voiceover generation via Clueso MCP.
- Sanitization: Not specified for OCR-derived content.
- [DYNAMIC_EXECUTION]: The skill utilizes the Clueso MCP to perform complex video orchestration tasks, including generating speech-synced clips and dynamic cursor animations based on generated narration.
Audit Metadata