Skills
Navigate
skills/clueso-ai/skills/spotlight-key-areas/Gen Agent Trust Hub

spotlight-key-areas

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied narration transcripts to determine video editing actions, creating a potential vector for indirect instructions.
  • Ingestion points: Processes narration transcripts as described in the workflow section of SKILL.md.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified for the transcript processing.
  • Capability inventory: Performs frame inspection, applies visual modifications (spotlights) to video projects, and shares project links.
  • Sanitization: No evidence of sanitization or content validation for the input narration is present.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to facilitate a connection to an external MCP server hosted by the vendor.
  • Evidence: References the vendor's MCP endpoint at https://connect.clueso.io/mcp and provides documentation links to help.clueso.io.
  • [COMMAND_EXECUTION]: The skill provides a CLI command for the agent to offer to the user to configure the necessary environment.
  • Evidence: Includes the command claude mcp add --transport http Clueso https://connect.clueso.io/mcp within SKILL.md for integration setup.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 06:27 AM