The Agent Skills Directory

[SAFE]: The skill is entirely composed of documentation and reference code snippets designed to teach the agent how to interact with the HeyGen V2 API. No executable code is bundled with the skill.
[EXTERNAL_DOWNLOADS]: The skill provides code examples for downloading generated video assets and uploading media to HeyGen's official domains (heygen.com, heygen.ai). These operations are well-known service functions associated with the skill's primary purpose and do not represent a security risk.
[COMMAND_EXECUTION]: The documentation contains standard curl command examples for API interaction. These are instructional placeholders for the agent or developer and do not contain malicious payloads or system-level tampering.
[DATA_EXPOSURE]: Authentication is handled via the HEYGEN_API_KEY environment variable. The skill does not access sensitive local files, hardcode credentials, or attempt to exfiltrate private data.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing user-supplied scripts and media assets. While this is an ingestion point for untrusted data, the output is a rendered video file, and the skill includes guidance on validating inputs, which aligns with best practices.

avatar-video