shorten-to-length
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the user to configure their environment by running the
claude mcp addcommand to integrate Clueso's specialized tools. - [EXTERNAL_DOWNLOADS]: The skill connects to a remote endpoint (
https://connect.clueso.io/mcp) to establish the Model Context Protocol connection with the vendor's infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which presents a vulnerability surface.
- Ingestion points: Processes external video projects, raw recordings, and user-provided must-keep lists (SKILL.md).
- Boundary markers: There are no explicit delimiters or instructions provided to ignore potentially malicious instructions embedded in video metadata or transcripts.
- Capability inventory: The skill performs file editing operations, narration regeneration, and exports via the
clueso-mcptoolset. - Sanitization: No evidence of sanitization or input validation for external content was found.
Audit Metadata