The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to propose and execute the command claude mcp add --transport http Clueso https://connect.clueso.io/mcp. This command modifies the agent's core configuration by adding a new Model Context Protocol (MCP) server, which expands the agent's capabilities and attack surface.
[EXTERNAL_DOWNLOADS]: The skill connects to an external endpoint (https://connect.clueso.io/mcp) to provision a tool. The domain clueso.io does not match the specific vendor resource patterns provided in the security guidelines (e.g., clueso-ai.io), which may indicate a typosquatting risk or an unauthorized external resource.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill ingests transcripts and rendered frames from video files, which are external, potentially untrusted inputs (SKILL.md).
Boundary markers: There are no explicit delimiters or instructions to ignore commands or malicious text that might be present in the video's audio transcript.
Capability inventory: The skill utilizes the clueso-mcp toolset to perform frame extraction and article generation.
Sanitization: While the skill suggests blurring sensitive visual data in screenshots, it lacks any sanitization or validation for the text extracted from the transcript to prevent embedded instructions from influencing agent behavior.

video-to-help-article