heygen-avatar
Fail
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to install the HeyGen CLI by downloading and executing a shell script from a remote URL (https://static.heygen.ai/cli/install.sh) using a piped command.
- [CREDENTIALS_UNSAFE]: The skill accesses the ~/.heygen/credentials file and utilizes the HEYGEN_API_KEY environment variable to authenticate with the HeyGen platform.
- [COMMAND_EXECUTION]: The agent uses the Bash tool to perform CLI operations and manage files during the avatar creation process.
- [DATA_EXFILTRATION]: Workspace identity files like SOUL.md and IDENTITY.md are read to extract personal traits which are subsequently sent to the HeyGen API to design avatars.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to fetch voice preview audio files from remote S3 buckets.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from workspace files (SOUL.md, IDENTITY.md) and user descriptions without explicit sanitization or boundary markers, and interpolates this content into prompts for avatar generation tools.
Recommendations
- HIGH: Downloads and executes remote code from: https://static.heygen.ai/cli/install.sh - DO NOT USE without thorough review
Audit Metadata