video-translate
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data that could contain malicious instructions.
- Ingestion points: The API request fields
video_url,srt_key(subtitles),instruction, andvocabulary(terms to preserve) are entry points for external data into the agent's workflow as seen inSKILL.md. - Boundary markers: The provided code snippets do not implement specific delimiters or 'ignore' instructions to isolate these external inputs from the agent's logic.
- Capability inventory: The skill possesses network capabilities to communicate with the HeyGen API (
api.heygen.com) and manages an API key (HEYGEN_API_KEY) via environment variables as documented inSKILL.md. - Sanitization: There is no evidence of input validation or sanitization for the strings passed to the API in the provided documentation or examples.
Audit Metadata