heygen
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a technical reference for integrating with the HeyGen video generation service. A thorough analysis across all 11 threat categories revealed no malicious patterns.
- [DATA_EXPOSURE]: The skill facilitates the transfer of local media assets (images, audio, video) to HeyGen's servers for processing. This is the core functionality and is used to provide background and talking photos for video generation. No unauthorized access to sensitive system directories or hardcoded credentials was detected.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests user-provided text to generate video scripts. However, this is the intended purpose of the skill, and it includes optimization guidelines to help structure these prompts safely. The risk is consistent with standard LLM-based content generation tools.
- [COMMAND_EXECUTION]: The provided code snippets use standard system calls for file reading and writing (fs in Node.js, open/requests in Python) to manage video assets, which is appropriate for the skill's utility.
Audit Metadata