topic-to-training-video
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides explicit instructions for the user to run commands (such as
claude mcp add) to install the necessary Clueso MCP connector. These are documented setup steps for the vendor's integration. - [REMOTE_CODE_EXECUTION]: The skill requires connecting to an external Model Context Protocol (MCP) server at
https://connect.clueso.io/mcp. This server provides the tools the agent uses to create and manage video projects. This resource is provided by the skill's vendor to enable its core functionality. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes untrusted user input (topics, prompts, or outlines) to generate video scripts.
- Ingestion points: Untrusted data enters the context via user-provided topics or outlines as described in the Inputs section of
SKILL.md. - Boundary markers: The skill implements safety boundaries by requiring the agent to confirm the learning objective and the full script with the user before calling any build tools.
- Capability inventory: The skill uses tools provided by the
clueso-mcpto create projects, add clips, generate narration, and export videos. - Sanitization: The workflow includes a mandatory manual review checkpoint where the user must approve the script, which acts as a filter for any malicious instructions embedded in the source material.
Audit Metadata