video-translate
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill makes network requests to
api.heygen.com, a well-known service for AI video translation. It utilizes theHEYGEN_API_KEYenvironment variable for authentication, which is a standard best practice for handling secrets.\n- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection due to its processing of untrusted external data.\n - Ingestion points: User-provided inputs including
video_url,video_id,callback_url,title, andvocabularyare processed by the skill inSKILL.md.\n - Boundary markers: The instructions do not implement specific delimiters or 'ignore' directives to prevent the agent from following instructions that might be embedded in the external content.\n
- Capability inventory: The skill uses
curl,fetch, and therequestslibrary to transmit user-derived data to an external API endpoint.\n - Sanitization: No input validation, filtering, or sanitization is demonstrated in the provided code snippets to protect against malicious input in the ingested fields.
Audit Metadata