split-into-series
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes video transcripts to identify topic boundaries and split points. This creates a potential surface for indirect prompt injection if a transcript contains malicious instructions intended to manipulate the agent's editing or export behavior.\n
- Ingestion points: Transcript content analyzed during the video splitting workflow (SKILL.md).\n
- Boundary markers: The instructions do not define specific delimiters or security boundaries for the transcript data.\n
- Capability inventory: The skill uses Clueso MCP tools for project creation, video editing, retiming narration, and exporting content.\n
- Sanitization: No mention of sanitizing or validating transcript content prior to processing.\n- [COMMAND_EXECUTION]: The documentation provides a command for users to connect the Clueso MCP server:
claude mcp add --transport http Clueso https://connect.clueso.io/mcp. This is a standard configuration step for using the Clueso service within Claude Code.\n- [EXTERNAL_DOWNLOADS]: The skill directs users to external resources for setup, including an MCP endpoint athttps://connect.clueso.io/mcp, setup guides onhelp.clueso.io, and official plugins for ChatGPT and Codex. These resources are managed by the vendor (Clueso) or official platform registries.
Audit Metadata