liveavatar-demo
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones reference repositories from the official GitHub organization of the vendor (heygen-com) to provide the code for Demo 1 (AI Sales Agent) and Demos 2/3 (LiveKit Agent starters).
- [COMMAND_EXECUTION]: The skill executes shell commands to install software dependencies (npm, uv), download model weights (via livekit-agents), and run setup scripts provided in the cloned repositories. These operations are restricted to the local development environment and target official vendor tools.
- [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote code by cloning external repositories and running their setup and development scripts. As these repositories are maintained by the skill's authoring organization (heygen-com) and represent the primary function of the skill, this behavior is documented as safe.
- [CREDENTIALS_UNSAFE]: The skill requests several API keys (LiveAvatar, Anthropic, LiveKit) required for the demos to function. It explicitly instructs the user to store these in
.env.localto prevent accidental inclusion in version control and recommends using text editors instead of shell commands to prevent keys from being saved in shell history logs.
Audit Metadata