The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to use npx to execute the @useclawlink/cli package. This is a vendor-owned package provided by the skill author for managing integrations.
[COMMAND_EXECUTION]: The skill relies on shell commands to interact with the HeyGen API via the ClawLink CLI, including commands for authentication, action discovery, and execution of video generation tasks.
[PROMPT_INJECTION]: The skill contains surfaces for indirect prompt injection by accepting user-provided strings and JSON objects that are directly passed to shell commands.
Ingestion points: User input in the actions command and JSON parameters in the run command.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are included in the command templates.
Capability inventory: The skill uses shell execution capabilities via the npx command.
Sanitization: The instructions do not specify validation or sanitization for external inputs before they are executed in the shell.
[PROMPT_INJECTION]: The skill's metadata contains conflicting information; the description mentions connecting by "pasting your API key," whereas the setup instructions in the body specify a browser-based login and state that no API key is needed. This documentation inconsistency could lead to user confusion but does not appear to be malicious.

heygen