faceswap
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions and code samples for using the HeyGen API to swap faces in videos.
- [SAFE]: Authentication is handled using the
HEYGEN_API_KEYenvironment variable, which is a secure method for managing sensitive credentials. - [SAFE]: All API requests are directed to
api.heygen.com, the official and legitimate endpoint for the service owned by the author (heygen-com). - [INDIRECT_PROMPT_INJECTION]: The skill integrates user-provided media URLs, which serves as a potential vector for indirect prompt injection via embedded metadata.
- Ingestion points:
source_image_urlandtarget_video_url(SKILL.md) - Boundary markers: Not used in provided code snippets.
- Capability inventory: Performs network POST requests to an external API (SKILL.md)
- Sanitization: None identified for the URL inputs.
Audit Metadata