talking-head-video

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes explicit curl/examples that place the HeyGen API key directly in request headers and tells the agent to read HEYGEN_API_KEY from .env, which encourages the LLM to read and insert secret values verbatim into generated commands/requests (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). The skill ingests outsider-authored free text when the user supplies a URL (or GitHub PR link) and the runtime fetches/reads the page/PR description/body for script/discovery (e.g., “URL” → browser screenshots + “reads the content”; “GitHub PR link” → reads PR description/commit messages), which can contain indirect prompt-injection text that is then placed into the agent/LLM context for script generation.