video-to-article
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to connect to a remote MCP server at
https://connect.clueso.io/mcp. This is a vendor-owned resource necessary for the skill's functionality. - [COMMAND_EXECUTION]: The skill provides a command (
claude mcp add --transport http Clueso https://connect.clueso.io/mcp) for the agent to configure its environment. The instructions explicitly state this should be done with user confirmation. - [PROMPT_INJECTION]: The skill processes untrusted external data (video transcripts) to extract information and generate content. This presents a surface for indirect prompt injection.
- Ingestion points: Video content and transcripts processed in the
Extract the argument structureandDraft the articlesteps. - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands in the processed transcripts.
- Capability inventory: The skill uses tools to write to Clueso projects, capture video frames, and generate images.
- Sanitization: No explicit sanitization or filtering of the transcribed text is mentioned.
Audit Metadata