The Agent Skills Directory

[DATA_EXFILTRATION]: The skill documents how to read local files and transmit them to HeyGen's API endpoints (upload.heygen.com). In references/assets.md and references/photo-avatars.md, code snippets show the use of file system read operations followed by network POST requests. This established capability to read from the host filesystem and send data externally presents a risk of data exfiltration if the agent is manipulated into reading sensitive files instead of intended media assets.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (prompts and file paths) and provides the agent with the capabilities to execute network operations and file reads based on that data. 1. Ingestion points: User-provided prompts in SKILL.md and asset file paths in references/assets.md. 2. Boundary markers: The instructions lack delimiters or explicit boundary markers to separate user-provided content from system instructions. 3. Capability inventory: The skill utilizes file system access (fs.readFileSync), network capabilities (fetch, requests), and external tool execution via MCP (mcp__heygen__*). 4. Sanitization: There is no evidence of input sanitization or schema validation to prevent malicious payloads from influencing the agent's behavior during video generation or asset processing.

heygen