faceswap

Pass

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides instructions and code samples for using the HeyGen API to swap faces in videos.
  • [SAFE]: Authentication is handled using the HEYGEN_API_KEY environment variable, which is a secure method for managing sensitive credentials.
  • [SAFE]: All API requests are directed to api.heygen.com, the official and legitimate endpoint for the service owned by the author (heygen-com).
  • [INDIRECT_PROMPT_INJECTION]: The skill integrates user-provided media URLs, which serves as a potential vector for indirect prompt injection via embedded metadata.
  • Ingestion points: source_image_url and target_video_url (SKILL.md)
  • Boundary markers: Not used in provided code snippets.
  • Capability inventory: Performs network POST requests to an external API (SKILL.md)
  • Sanitization: None identified for the URL inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 14, 2026, 10:07 AM
Security Audit — agent-trust-hub — faceswap