skills/clawlink-hq/skills/heygen/Socket

heygen

Warn

Audited by Socket on Jun 28, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill's broad purpose is coherent, but the actual integration path is a third-party gateway that intermediates HeyGen access and holds the service token server-side. That proxy data flow, combined with local credential storage and unpinned `npx` execution, makes the skill medium/high risk even without confirmed malicious behavior.

Confidence: 84%Severity: 69%

Audit Metadata

Analyzed At

Jun 28, 2026, 02:46 PM

Package URL

pkg:socket/skills-sh/clawlink-hq%2Fskills%2Fheygen%2F@5209fbb7d4ddb0ce0008714907d4a1100d0f69eadbb3db3e338f04fc6d380486