ai-video-gen
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: All demonstrated network requests (curl, fetch, requests) target the official HeyGen API domain (api.heygen.com) or well-known providers like Google Gemini and fal.ai.
- [SAFE]: The skill implements best practices for secret management by instructing users to set environment variables (e.g., HEYGEN_API_KEY, FAL_KEY) rather than hardcoding credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-inputted prompts for video generation. 1. Ingestion points: 'input.prompt' field in API request payloads. 2. Boundary markers: None identified in the provided examples. 3. Capability inventory: Performs network operations to trigger remote video generation. 4. Sanitization: None identified; the skill relies on the provider's API for content filtering.
Audit Metadata