shorten-to-length
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the user to execute a command to install a Model Context Protocol (MCP) connector.
- Evidence:
claude mcp add --transport http Clueso https://connect.clueso.io/mcpinSKILL.md. - Context: This is a documented setup step to enable the skill's core functionality. The instruction explicitly states it should be run with the user's confirmation.
- [EXTERNAL_DOWNLOADS]: The skill references an external URL for its required MCP server.
- Evidence:
https://connect.clueso.io/mcpinSKILL.md. - Context: The resource belongs to the vendor's official domain (clueso.io) and is essential for the video editing operations.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external video project data and user-provided instructions, which represents a standard attack surface for indirect prompt injection.
- Ingestion points: Processes existing Clueso project data and raw recordings provided by the user in the "Inputs" section of
SKILL.md. - Boundary markers: No specific boundary markers are defined for the ingested data.
- Capability inventory: Uses Clueso MCP tools for video triage, narration regeneration, and project export as described in the "Workflow" section.
- Sanitization: The skill mitigates risks by requiring explicit user sign-off on editorial plans and review links before final export.
Audit Metadata