create-video
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized access attempts were detected. The skill's behavior is consistent with its stated purpose of interacting with the HeyGen video generation platform.
- [EXTERNAL_DOWNLOADS]: The skill documents how to download completed videos and thumbnails from HeyGen's official domains (heygen.ai, heygen.com), which are recognized as well-known services.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect injection as it processes untrusted inputs into an AI-driven workflow. This is a characteristic of the intended primary use case.
- Ingestion points: Asset local paths and remote URLs (references/assets.md), and user-supplied text prompts (references/video-agent.md).
- Boundary markers: Absent in provided code snippets.
- Capability inventory: File system read/write access (fs.readFileSync, fs.writeFileSync) and network communication (fetch, requests).
- Sanitization: Absent in provided code snippets.
- [DATA_EXFILTRATION]: Instructions include sending user-provided prompts and local media assets to HeyGen for processing, which is the primary intended function of the skill. Authentication is handled via standard environment variables.
Audit Metadata