heygen
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a set of tools to interface with the HeyGen V3 API (api.heygen.com). All network communications are directed to this official domain.
- [SAFE]: Authentication is handled using a static API key passed via the X-Api-Key header. The skill provides clear instructions for users to manage this credential via environment variables (HEYGEN_API_KEY) or a managed Zapier connection, avoiding hardcoded secrets.
- [SAFE]: The entry point logic in cli.js is a standard boilerplate used to handle different Node.js environments and TypeScript execution. It does not perform unauthorized command execution or download remote scripts at runtime.
- [SAFE]: All identified dependencies (zod, @zapier/connectors-sdk, @modelcontextprotocol/sdk) are reputable and standard for AI agent connectors.
- [SAFE]: There are no signs of prompt injection, data exfiltration to unauthorized domains, or obfuscation techniques.
Audit Metadata