tella
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes video timelines, storyboards, and transcripts from external video projects, which represents an ingestion surface for untrusted data.
- Ingestion points: Video metadata, transcripts, and timeline data are retrieved via the
get_timelineandget_storyboardtools inSKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within the processed data are specified in the instructions.
- Capability inventory: The skill possesses write capabilities through tools like
update_videoandupdate_clip, allowing for the modification of video content based on processed data. - Sanitization: No specific sanitization or filtering logic for transcripts or user-provided media metadata is described.
- [EXTERNAL_DOWNLOADS]: The documentation provides setup instructions using
npx mcp-remoteto connect to the remote Tella MCP server. - Evidence: The skill references
npx mcp-remote https://api.tella.com/mcpas a connection method inSKILL.md. - Context: These instructions are provided for user-initiated configuration and target the official vendor domain (
tella.com).
Audit Metadata