The Agent Skills Directory

[SAFE]: The skill interacts with the official HeyGen API (api.heygen.com), which is a well-known AI video generation service. Communications are performed using standard protocols and tools.
[SAFE]: Authentication is managed via the HEYGEN_API_KEY environment variable. The skill correctly instructs the user to set this in the environment rather than hardcoding sensitive credentials.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided URLs for source images and target videos. While these ingestion points represent a potential attack surface, the risk is mitigated because the data is passed directly to the HeyGen API for specific GPU-accelerated processing rather than being parsed as instructions or executed locally.
Ingestion points: source_image_url and target_video_url parameters defined in SKILL.md.
Boundary markers: None present in the provided instructions.
Capability inventory: Performs network POST and GET requests to api.heygen.com using curl, requests (Python), and fetch (TypeScript).
Sanitization: None present; the skill relies on the external API provider's sanitization and processing logic.

faceswap