avatar-video
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: CRITICALINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions and reference materials describe a workflow that ingests and processes untrusted external data, forming a surface for indirect prompt injection.
- Ingestion points: User-provided script text for text-to-speech, background URLs, and custom asset binary uploads (images, video, audio) are integrated into video generation requests as demonstrated in
references/video-generation.mdandreferences/assets.md. - Boundary markers: The instructions do not utilize specific delimiters or 'ignore' warnings for the data interpolated into these API calls.
- Capability inventory: The skill facilitates network operations via API calls to HeyGen (
POST /v2/video/generate), which may consume user credits or resources based on the ingested content. - Sanitization: No validation or sanitization logic is described for the speech scripts or external asset URLs before they are transmitted to the remote service.
- [EXTERNAL_DOWNLOADS]: The skill documentation includes examples of downloading and fetching content from external sources.
- Neutral Documenting: The skill fetches avatar preview assets and downloads generated video files from HeyGen's official domains (
files.heygen.ai,resource2.heygen.ai) and API endpoints (api.heygen.com). These are recognized vendor services and the downloads are consistent with the skill's primary documented purpose.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata