heygen-video
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends downloading and installing the HeyGen CLI from the vendor's official domain (static.heygen.ai). This is a standard setup procedure for the vendor's tools.
- [REMOTE_CODE_EXECUTION]: The instructions contain a setup command that pipes a remote script from the vendor's official domain to bash. This pattern is used for legitimate tool installation by the skill author and does not target untrusted sources.
- [COMMAND_EXECUTION]: The skill utilizes the 'heygen' CLI to perform video generation, avatar management, and voice selection. These commands are necessary for the skill's primary functionality and are invoked using standard parameters.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external URLs and user-provided files which represents a potential attack surface. To mitigate this, the skill employs structured prompt blocks and explicit instructions to the AI agent to distinguish between content and commands.
- [SAFE]: The included 'update-check.sh' script is a benign utility that checks for skill updates by comparing the local version against the vendor's official repository on GitHub.
Audit Metadata