ai-video-gen
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill initiates network requests to
api.heygen.comandresource.heygen.aito facilitate video generation and retrieval. These requests target well-known service provider domains associated with the skill's primary purpose. - [COMMAND_EXECUTION]: The skill provides example
curlcommands and implementation snippets in TypeScript and Python for communicating with the HeyGen API. These examples demonstrate standard API interaction patterns. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided strings and URLs for video generation prompts and reference images.
- Ingestion points:
input.prompt,input.reference_image_url, andinput.tail_image_urlfields inSKILL.md. - Boundary markers: Data is transmitted within a structured JSON object, providing programmatic separation between instructions and content.
- Capability inventory: The skill performs network POST requests and provides CLI command templates in
SKILL.md. - Sanitization: The skill relies on the downstream API providers to handle prompt safety, which is standard for generation interfaces.
Audit Metadata