text-to-speech
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with official HeyGen API endpoints (api.heygen.com) and resource domains (resource.heygen.ai, resource2.heygen.ai) to list available voices and download generated audio files. These represent legitimate interactions with the target service.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies a data ingestion point where user-provided text is passed to the text-to-speech API. While no explicit boundary markers or sanitization steps are detailed in the snippets, the skill's capabilities are limited to network operations targeting official HeyGen endpoints, aligning with its primary functional purpose.
Audit Metadata