playbook-to-training-video
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (pasted text, uploaded files, or external articles) to generate scripts and video content. This creates a surface where malicious instructions hidden in a playbook or SOP could attempt to override the agent's scripting logic or video generation parameters.
- Ingestion points: Processes user-supplied text or file content as source material in the 'Inputs' section.
- Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the source documents.
- Capability inventory: The skill utilizes Clueso MCP tools for project management, script generation, media placement, narration, and video exporting.
- Sanitization: No explicit sanitization or validation of the input text content is defined in the workflow.
- [EXTERNAL_DOWNLOADS]: The instructions guide the user to install external plugins and connect to remote MCP endpoints to enable functionality.
- The skill references
https://connect.clueso.io/mcpas the transport address for Claude Code and Claude Desktop connectors. - It references specific ChatGPT and Codex plugin IDs (
app-6a310833394081919705b0a3ee745267) for installation. - These resources are verified as belonging to the skill's authoring vendor (Clueso) and are required for the tool's operation.
Audit Metadata