video-translate
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could be crafted to include malicious instructions for the agent or the downstream video processing engine.
- Ingestion points: External data enters through the
video_url,instruction,vocabulary, andsrt_keyfields defined inSKILL.md. - Boundary markers: There are no explicit delimiters or safety instructions provided to isolate these user-controlled inputs from the agent's task instructions.
- Capability inventory: The skill is authorized to use
mcp__heygen__*tools to make network requests toapi.heygen.comand potentially access local files via thesrt_keyparameter. - Sanitization: The provided code examples demonstrate direct interpolation of config objects into JSON request bodies without explicit validation or sanitization of the input values.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to
https://api.heygen.comfor submitting translation jobs and retrieving results. This domain is the official endpoint for HeyGen, a well-known AI video translation service.
Audit Metadata