HeyGen AI Avatar Video (Lite)

PassAudited by ClawScan on May 1, 2026.

Overview

This is a benign instruction-only HeyGen API guide, but it asks you to use a HeyGen API key and includes paid/referral links.

This skill appears safe as a documentation-only starter guide. Before installing or using it, remember that the examples require your HeyGen API key, may consume paid credits, and send your script/avatar choices to HeyGen. Keep API keys private and verify any referral or premium purchase links independently.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

If the key is exposed or used carelessly, someone could access HeyGen API features or consume credits on the user's account.

Why it was flagged

The guide requires a HeyGen API key and uses it in API requests. This is expected for the stated HeyGen integration, but it gives access to the user's HeyGen account/API quota.

Skill content

HEYGEN_API_KEY="your_api_key_here" ... -H "X-Api-Key: $HEYGEN_API_KEY"

Recommendation

Use a revocable API key, keep it out of shared chats/logs, review requests before running them, and rotate the key if it may have been exposed.

Note

ASI02: Tool Misuse and Exploitation

What this means

Running the example with real values may send script text and avatar/voice selections to HeyGen and may use paid video credits.

Why it was flagged

The example command sends text, avatar, and voice choices to HeyGen to generate a video. This is central to the skill's purpose, but it is an external API action that can consume credits.

Skill content

curl -X POST "https://api.heygen.com/v2/video/generate" ... "input_text": "Hello! This is my AI avatar speaking."

Recommendation

Confirm the payload, account costs, and any sensitive script content before executing the API request.

Note

ASI09: Human-Agent Trust Exploitation

What this means

The skill may steer users toward a specific signup link or paid external offering.

Why it was flagged

The guide includes a referral-style sign-up link and a paid premium upsell. This is disclosed promotional content rather than hidden behavior.

Skill content

[Sign up for HeyGen](https://www.heygen.com/?sid=rewardful&via=clawhub) ... **Premium Version** includes: ... Get it on [Virtuals ACP] ... ($8 USD)

Recommendation

Treat pricing, referral benefits, and premium-package claims as marketing and verify them independently before paying or signing up.