media-use

Fail

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's documentation includes a command to install the heygen CLI utility via a shell script hosted at static.heygen.ai. This is the official installation method for the service.\n- [COMMAND_EXECUTION]: The scripts invoke the heygen and ffprobe command-line tools. These invocations are performed using execFileSync with literal argument arrays, which prevents shell-based command injection vulnerabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which could potentially contain malicious instructions.\n
  • Ingestion points: Natural language input provided via the --intent command-line flag and asset metadata retrieved from external searches.\n
  • Boundary markers: The skill does not use specific delimiters or instructions to isolate external data from its internal logic.\n
  • Capability inventory: The skill has the ability to execute specific shell commands, perform network downloads, and write files to both the project directory and a global cache in the user's home directory.\n
  • Sanitization: Command execution is sanitized by avoiding shell interpolation, ensuring that data is treated as literal arguments.
Recommendations
  • HIGH: Downloads and executes remote code from: https://static.heygen.ai/cli/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Nov 1, 2026, 09:33 PM