talking-head-video
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill adheres to security best practices by utilizing a local
.envfile for API key management, ensuring that sensitive credentials are not hardcoded within the instructions or scripts. - [EXTERNAL_DOWNLOADS]: The skill communicates with official HeyGen API endpoints (api.heygen.com and upload.heygen.com) to manage assets and generate videos. These interactions are legitimate and necessary for the skill's functionality.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute standard curl commands for interacting with the HeyGen API. These commands are used for asset uploading and status polling as intended.
- [PROMPT_INJECTION]: The skill is designed to ingest data from external sources such as URLs and GitHub pull requests to generate video scripts. This creates a surface for indirect prompt injection; however, this is a functional requirement for the skill's purpose and represents the intended data flow for content processing.
Audit Metadata