The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided prompts to generate video content. The documentation notes that the underlying engine interprets instructions for visual layouts and motion graphics, creating an inherent surface for potential indirect prompt injection where crafted input could attempt to override intended output. This is a low-risk characteristic typical of generative AI services.
Ingestion points: The prompt parameter in mcp__heygen__generate_video_agent and the script parameter in video generation endpoints.
Boundary markers: No delimiters or explicit safety warnings for user-interpolated content are defined in the provided templates.
Capability inventory: The skill calls external APIs at heygen.com to generate and process video content.
Sanitization: No sanitization logic for user input is documented within the skill instructions.
[CREDENTIALS_SAFE]: The skill manages authentication via the HEYGEN_API_KEY environment variable. The documentation correctly identifies this as a requirement and provides examples for setting it up in secure local environments using .env files rather than hardcoding credentials.
[EXTERNAL_DOWNLOADS]: All network operations and asset uploads target official HeyGen domains including api.heygen.com, upload.heygen.com, and heygen.ai. These are recognized as legitimate and well-known services associated with the skill's primary purpose.

heygen