liveavatar-demo

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to ask the user to paste API keys into chat and then to place those keys into .env.local (writing them with an editor), which requires the LLM to receive and output secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored free text via the user’s microphone/audio and sends that user-provided content into the STT→LLM pipeline (Demos 2/3) and the lead-capture/“Chat with Wayne” UI for conversation turns (Demo 1) without any first selecting a specific pre-approved item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clones and runs code from external GitHub repos at runtime (e.g., git clone https://github.com/heygen-com/liveavatar-starter-livekit-agent-python and git clone https://github.com/heygen-com/liveavatar-sales-agent), which pulls remote code that is installed/executed and therefore can directly control agent behavior.