playbook-to-training-video

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (pasted text, uploaded files, or external articles) to generate scripts and video content. This creates a surface where malicious instructions hidden in a playbook or SOP could attempt to override the agent's scripting logic or video generation parameters.
  • Ingestion points: Processes user-supplied text or file content as source material in the 'Inputs' section.
  • Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the source documents.
  • Capability inventory: The skill utilizes Clueso MCP tools for project management, script generation, media placement, narration, and video exporting.
  • Sanitization: No explicit sanitization or validation of the input text content is defined in the workflow.
  • [EXTERNAL_DOWNLOADS]: The instructions guide the user to install external plugins and connect to remote MCP endpoints to enable functionality.
  • The skill references https://connect.clueso.io/mcp as the transport address for Claude Code and Claude Desktop connectors.
  • It references specific ChatGPT and Codex plugin IDs (app-6a310833394081919705b0a3ee745267) for installation.
  • These resources are verified as belonging to the skill's authoring vendor (Clueso) and are required for the tool's operation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 06:27 AM