Hg Skills Republish 221

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:03 AM UTC
• Version: 2.2.1

Overview

This HeyGen video skill is mostly purpose-aligned, but its install and data-handling instructions give agents too much unsafeguarded authority.

Review before installing. Prefer MCP OAuth where possible, do not paste broad install prompts that let an agent 'do the rest,' avoid curl-to-bash installers unless you independently trust and verify them, pin and verify any OpenClaw plugin, keep API keys out of global shell profiles when possible, and approve each raw file/photo upload to HeyGen explicitly.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:48
• Finding: Unverified Remote Installer Is Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `README.md:48-52` **Additional Locations**: `CLAUDE.md:78`, `INSTALL.md:41`, `INSTALL.md:55`, `INSTALL_FOR_AGENTS.md:152-156`, `SKILL.md:68`, `heygen-avatar/SKILL.md:58`, `platforms/nanoclaw/heygen/SKILL.md:13-14` **Vulnerability Type**: Remote code retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://static.heygen.ai/cli/install.sh | bash ``` The root Skill also directs agents to recommend the same command automatically: ```text 5. **Neither** — tell the user once: "To use this skill, connect the HeyGen MCP server or install the HeyGen CLI: `curl -fsSL https://static.heygen.ai/cli/install.sh | bash` then `heygen auth login`." ``` ### Technical Analysis The response from `https://static.heygen.ai/cli/install.sh` is passed directly to Bash. The repository does not pin an immutable installer version, verify a cryptographic checksum or signature, save the script for inspection, or constrain the resulting process. Although the hostname appears associated with the declared service, the audited repository does not contain the installer and cannot establish what it currently does or what it may do later. Compromise of the origin, CDN, DNS path, publishing credentials, or installer pipeline would turn the documented installation operation into arbitrary code execution. This behavior exceeds the minimum privileges necessary to install a CLI. A versioned binary can be downloaded and verified without granting a mutable network response immediate shell execution. ### Attack Path 1. A user invokes the Skill on a system where the HeyGen CLI is unavailable. 2. The Skill instructs the user or shell-capable agent to execute the one-line installer. 3. An attacker compromises the installer origin, distribution path, or publishing account and replaces the response. 4. `curl` retrieves the modified response. 5. Bash executes the response under the invoking user's pr ...[truncated 717 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every `curl ... | bash` instruction from all Skill and installation documents. 2. Publish immutable, versioned CLI artifacts instead of a mutable installer response. 3. Publish SHA-256 checksums and, preferably, signatures backed by a documented signing key. 4. Use a staged installation process such as: ```bash curl -fL -o heygen-cli.tar.gz "https://trusted.example/heygen-cli-vX.Y.Z.tar.gz" echo "<expected-sha256> heygen-cli.tar.gz" | sha256sum -c - ``` 5. Require the user to inspect or explicitly approve the verified artifact before installation. 6. Document the files, directories, and permissions the installer will modify. 7. Prefer a reputable package manager with pinned versions and package-signature verification. 8. If an installer script remains available, download it to disk and verify its signature before running it; never execute the network stream directly. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:13
• Finding: Mutable Remote Installation Instructions Are Treated as Authoritative Agent Commands<![CDATA[ ## Vulnerability Details **File Location**: `README.md:13-22` **Additional Location**: `INSTALL_FOR_AGENTS.md:10-23` **Vulnerability Type**: Mutable remote instruction loading **Risk Level**: High ### Vulnerable Code ```text **Paste this into your agent.** It does the rest — clones the repo to the right path, asks for your HeyGen API key, picks the best transport, runs a verify test, and ends with a working video. Read https://raw.githubusercontent.com/heygen-com/skills/master/INSTALL_FOR_AGENTS.md and follow it. Ask me for any API keys you need. ``` The remotely loaded guide further identifies mutable companion instructions: ```text - `https://raw.githubusercontent.com/heygen-com/skills/master/CLAUDE.md` — runtime contract for the skills - `https://raw.githubusercontent.com/heygen-com/skills/master/SKILL.md` — top-level skill (mode detection ladder, hard rules) - `https://raw.githubusercontent.com/heygen-com/skills/master/heygen-avatar/SKILL.md` — avatar creation sub-skill - `https://raw.githubusercontent.com/heygen-com/skills/master/heygen-video/SKILL.md` — video generation sub-skill - `https://raw.githubusercontent.com/heygen-com/skills/master/INSTALL.md` — human-facing install doc ``` ### Technical Analysis The recommended installation procedure tells an agent to retrieve and follow instructions from the mutable `master` branch. Those instructions can change after the reviewed Skill package is published or audited. This establishes a remote control channel for agent behavior. The fetched text is not merely data: it is explicitly treated as an authoritative installation specification and is allowed to request API keys, execute shell commands, clone repositories, install plugins, restart services, and modify configuration. No commit hash, content digest, signature, or expected-content verification binds the remote documents to the audited version. A repository compromise or malicious future update can therefore alter the effective Skill be ...[truncated 1171 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle installation instructions inside the reviewed Skill package and make local files authoritative. 2. Do not instruct an agent to follow arbitrary text from a mutable branch. 3. If remote retrieval is unavoidable, pin every URL to a reviewed commit hash: ```text https://raw.githubusercontent.com/heygen-com/skills/<reviewed-commit>/INSTALL_FOR_AGENTS.md ``` 4. Publish and verify a digest or signature for remotely retrieved instruction files. 5. Separate documentation retrieval from command execution. The agent should display proposed commands and obtain explicit approval before running them. 6. Never give remotely retrieved text blanket authorization to request or handle secrets. 7. Constrain installation actions to a documented allowlist of paths and commands. 8. Require renewed review and user approval whenever the pinned installation specification changes. ]]>

T08 · Insecure Dependencies

Error

• Location: INSTALL_FOR_AGENTS.md:125
• Finding: Unpinned OpenClaw Plugin Is Installed with Access to the API Key<![CDATA[ ## Vulnerability Details **File Location**: `INSTALL_FOR_AGENTS.md:125-145` **Additional Location**: `SKILL.md:94` **Vulnerability Type**: Unpinned executable dependency installation **Risk Level**: High ### Vulnerable Code ```bash openclaw plugins install openclaw-plugin-heygen ``` The same section grants the installed plugin access to authentication material and loads it into the agent host: ```text The plugin reads `HEYGEN_API_KEY` from the environment (set in Step 3). Restart the gateway to pick up the new provider registration: ```bash openclaw gateway restart ``` ``` A different package identifier appears in the root Skill: ```bash openclaw plugins install clawhub:@heygen/openclaw-plugin-heygen ``` ### Technical Analysis The plugin installation does not specify an exact version, integrity digest, signature, or immutable source revision. The plugin executes inside OpenClaw and is deliberately trusted with `HEYGEN_API_KEY`, video prompts, identifiers, and generation traffic. The project uses two inconsistent installation identifiers—`openclaw-plugin-heygen` and `clawhub:@heygen/openclaw-plugin-heygen`. This ambiguity increases provenance and dependency-confusion risk because the package selected by one command may not be the package reviewed or intended by the other. Restarting the gateway activates the newly installed executable component immediately. ### Attack Path 1. An agent follows Option A and resolves the unpinned plugin identifier through the configured registry. 2. An attacker compromises the publisher account, registry entry, package distribution channel, or an ambiguous similarly named package. 3. The latest resolved package contains malicious code. 4. The agent installs the package and restarts the OpenClaw gateway. 5. The plugin loads with access to `HEYGEN_API_KEY` and video-generation calls. 6. The plugin exfiltrates the credential, alters requests, captures uploaded content, or invokes other capabilities exposed by t ...[truncated 410 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Select and document one canonical package identifier. 2. Pin an exact reviewed plugin version rather than installing the latest release. 3. Require registry integrity verification, a package digest, or a publisher signature. 4. Verify the publisher namespace and repository linkage before installation. 5. Display the plugin's requested permissions and obtain explicit user approval. 6. Avoid exposing the API key to the entire gateway environment where possible; use a scoped secret injection mechanism available only to the intended plugin. 7. Review the pinned plugin source for secret handling, network destinations, update behavior, and filesystem access. 8. Do not restart and activate the plugin automatically until installation integrity has been verified. 9. Apply the same pinning and review controls to future plugin upgrades. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: INSTALL_FOR_AGENTS.md:89
• Finding: Long-Lived API Key Is Stored in Plaintext Shell Startup Files<![CDATA[ ## Vulnerability Details **File Location**: `INSTALL_FOR_AGENTS.md:89-104` **Additional Locations**: `README.md:55-61`, `README.md:151-155`, `INSTALL.md:42` **Vulnerability Type**: Insecure plaintext credential storage **Risk Level**: Medium ### Vulnerable Code ```text The safe default is to set it as an environment variable in the user's shell profile. ```bash # In ~/.zshrc, ~/.bashrc, or wherever the user's shell loads env vars: export HEYGEN_API_KEY=hg_... ``` ``` The guide also permits project-local plaintext storage: ```text If the user prefers a project-local key, drop it in `.env` and tell the user to never commit it. ``` The README repeats the persistent shell-profile recommendation: ```bash export HEYGEN_API_KEY=<your-key> ``` ```text To persist across sessions, add `export HEYGEN_API_KEY=<your-key>` to your shell profile (`~/.zshrc`, `~/.bashrc`, or equivalent). ``` ### Technical Analysis Shell startup files are not dedicated secret stores. They are frequently copied into dotfile repositories, included in diagnostics and backups, read by unrelated interactive shells, or exposed through accidental terminal output. Environment variables are also inherited by child processes, broadening credential exposure beyond the HeyGen CLI. A project-local `.env` file creates an additional source-control disclosure risk. Merely warning the user not to commit it does not enforce restrictive permissions, ignore rules, redaction, or secret scanning. The API key authorizes separately billed API usage, so disclosure can produce direct financial impact. ### Attack Path 1. The user or agent writes `HEYGEN_API_KEY` into `.zshrc`, `.bashrc`, or `.env`. 2. A local process, debugging tool, backup product, support bundle, shell-history workflow, or dotfile synchronization reads the plaintext value. 3. Alternatively, a project-local `.env` file is accidentally committed or uploaded. 4. An attacker retrieves the key. 5. The attacker uses the key for unaut ...[truncated 600 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer MCP OAuth so the Skill does not handle a reusable API key. 2. For CLI authentication, prefer an operating-system credential manager or the CLI's documented secure credential mechanism. 3. Do not describe plaintext shell-profile storage as the safe default. 4. If file-based storage is unavoidable: - Use a dedicated credential file outside the project. - Set permissions to `0600`. - Avoid exporting the key globally to all child processes. - Load it only for the specific command that needs it. 5. Add `.env` to `.gitignore` before creating it and verify that it is not already tracked. 6. Provide a `.env.example` containing only the variable name, never a real value. 7. Redact secrets from command output, logs, screenshots, and support instructions. 8. Document revocation and rotation procedures for potentially exposed keys. 9. Recommend a narrowly scoped key if HeyGen provides scope controls. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/asset-routing.md:22
• Finding: Ambiguous Local Files Default to Full Third-Party Upload Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `references/asset-routing.md:22-27` **Additional Locations**: `references/asset-routing.md:74-86`, `SKILL.md:201-208`, `heygen-video/SKILL.md:91-102` **Vulnerability Type**: Excessive data transmission and failure of least-privilege controls **Risk Level**: High ### Vulnerable Code ```text 2. Should the viewer SEE this asset? - Screenshot, logo, product image, chart → YES → Path B - Research doc, article, context material → NO → Path A - Ambiguous → Path A+B 3. Is the content too long for the prompt? - Short (< 500 words) → fits in prompt - Long (> 500 words) → summarize key points, attach full doc ``` Path B is defined as transmitting the raw file: ```text | **B: Attach to API** | Upload the raw file via `files[]`. Video Agent analyzes, extracts graphics, uses as frames/B-roll. | | **A+B: Both** | Contextualize for script quality AND attach for visual use. | ``` The mandatory routing rules reinforce the upload default: ```text - **Never ask the user which path unless genuinely 50/50.** You're the producer. Make the call. - **When in doubt, do both (A+B).** Over-providing costs nothing. ``` The documented upload operation is: ```bash heygen asset create --file /path/to/file.png ``` ### Technical Analysis Providing a file to an agent for local summarization or contextual analysis does not necessarily authorize transmission of the complete file to HeyGen. The routing logic defaults ambiguous cases to A+B, where the raw file is uploaded, and instructs the agent not to ask the user unless the decision is exactly balanced. The statement that “over-providing costs nothing” disregards confidentiality, personal-data exposure, third-party retention, contractual restrictions, and data-minimization requirements. For contextual documents, Path A can satisfy the declared task without sending the full original. The root Skill states that assets are uploaded when users explicitly provide them “ ...[truncated 1354 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default ambiguous assets to Path A, which keeps the original local. 2. Before every raw-file upload, explicitly disclose: - The exact file that will be sent. - That it will be transmitted to HeyGen. - Why the complete file is needed. - Whether a reduced or redacted alternative is available. 3. Obtain affirmative user confirmation before invoking `heygen asset create`, embedding base64 data, or attaching an asset through MCP. 4. Apply data minimization: - Extract only required pages. - Crop screenshots. - Remove metadata. - Redact credentials and personal data. - Upload derived charts or selected images instead of complete documents. 5. Never treat document length alone as justification for uploading the full source. 6. Add warnings for confidential, regulated, auth-related, and personally identifiable content. 7. Record the user's upload approval in the local operation log without storing the sensitive content itself. 8. Document deletion and retention controls for uploaded HeyGen assets where supported. 9. Replace “over-providing costs nothing” with an explicit privacy-first rule: transmit only what is necessary for the approved output. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (61)

External Script Fetching

High

• Category: Supply Chain

Content

**CLI with API key (recommended for agents):**
```bash
curl -fsSL https://static.heygen.ai/cli/install.sh | bash
export HEYGEN_API_KEY=<your-key>
heygen --version        # verify binary is on PATH
heygen auth status      # verify auth

• Confidence: 97% confidence
• Finding: `curl ... | bash` is a direct remote code execution pattern: content retrieved at runtime from an external server is immediately executed by the shell. If the remote server, DNS, TLS termination, CDN path, or script distribution process is compromised, an attacker can run arbitrary commands on the user's machine or agent host.

Chaining Abuse

High

• Category: Tool Misuse

Content

**CLI with API key (recommended for agents):**
```bash
curl -fsSL https://static.heygen.ai/cli/install.sh | bash
export HEYGEN_API_KEY=<your-key>
heygen --version        # verify binary is on PATH
heygen auth status      # verify auth

• Confidence: 96% confidence
• Finding: The `| bash` chaining construct suppresses the opportunity to inspect downloaded content before execution and is a classic unsafe bootstrap mechanism. In a skill installation document, this pattern normalizes blind trust of remote code and can be exploited for full command execution on the target environment.

External Script Fetching

High

• Category: Supply Chain

Content

Paste this prompt to your agent — it will find the right paths automatically:

> Install the HeyGen Skills from https://github.com/heygen-com/skills.git — clone it into your skills directory (find it with your config or ask if unsure). Install the HeyGen CLI via `curl -fsSL https://static.heygen.ai/cli/install.sh | bash` and export HEYGEN_API_KEY=\<your-key\> (get one at https://app.heygen.com/api). Or, if you're on a HeyGen plan and already have MCP connected to your agent, skip the key step — MCP will be used automatically. Then use the heygen-avatar skill to create an avatar for me, and heygen-video to make a 30-60 second intro video, casual tone.

• Confidence: 96% confidence
• Finding: The same external-script execution pattern appears inside a copy-paste prompt intended for an agent, which increases the chance of blind execution. In this context the risk is amplified because an autonomous or semi-autonomous agent may perform the command with minimal user scrutiny, leading to arbitrary code execution and possible credential access on the host.

External Script Fetching

High

• Category: Supply Chain

Content

### Option B: HeyGen CLI (works with any agent that can shell out)

```bash
curl -fsSL https://static.heygen.ai/cli/install.sh | bash
```

Then sign in:

• Confidence: 99% confidence
• Finding: The guide instructs agents/users to execute a remote install script directly from the network via curl piped to bash, which gives the remote server immediate code execution on the host without prior verification. If the hosting domain, transport, or script content is compromised, an attacker could run arbitrary commands, steal credentials, alter configs, or install persistence.

Chaining Abuse

High

• Category: Tool Misuse

Content

### Option B: HeyGen CLI (works with any agent that can shell out)

```bash
curl -fsSL https://static.heygen.ai/cli/install.sh | bash
```

Then sign in:

• Confidence: 99% confidence
• Finding: The shell pipeline chaining remote content directly into bash removes any opportunity for inspection and amplifies the risk of arbitrary code execution from untrusted or tampered content. In an agent-install context this is especially dangerous because the command may be run with the user's privileges and in an environment that holds API keys, PATH settings, and other sensitive configuration.

External Script Fetching

High

• Category: Supply Chain

Content

One-line install (macOS / Linux):

```bash
curl -fsSL https://static.heygen.ai/cli/install.sh | bash
```

Then set your API key:

• Confidence: 97% confidence
• Finding: The command pipes a remotely fetched shell script directly into bash, which executes unreviewed code from the network without integrity verification. If the hosting domain, TLS trust chain, CDN path, or upstream script is compromised, users could suffer arbitrary code execution on their machine during installation.

Chaining Abuse

High

• Category: Tool Misuse

Content

One-line install (macOS / Linux):

```bash
curl -fsSL https://static.heygen.ai/cli/install.sh | bash
```

Then set your API key:

• Confidence: 95% confidence
• Finding: The '| bash' construct is a classic chaining-abuse pattern because it combines retrieval and execution in one step, eliminating any review boundary. In an agent-skill context this is more dangerous, since an agent may execute the pipeline automatically or recommend it to users, amplifying the risk of remote code execution from a single prompt.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The code's primary purpose is entirely different from the declared description. Nothing in the script interacts with api.heygen.com, creates videos, manages avatars, performs prompt engineering, corrects aspect ratios, or selects voices. Instead, it implements periodic version checking for the skill package itself using local files and a remote GitHub-hosted VERSION file. This is a clear description-behavior mismatch, not merely a supporting detail.

External Script Fetching

High

• Category: Supply Chain

Content

2. **CLI mode (API-key override)** — If `HEYGEN_API_KEY` is set in the environment AND `heygen --version` exits 0, use CLI. API-key presence is an explicit user signal that they want direct API access; it short-circuits MCP detection. No question asked.
3. **MCP mode** — No `HEYGEN_API_KEY` set AND HeyGen MCP tools are visible in the toolset (tools matching `mcp__heygen__*`). OAuth auth, uses existing plan credits.
4. **CLI mode (fallback)** — MCP tools NOT available AND `heygen --version` exits 0. Auth via `heygen auth login` (persists to `~/.heygen/credentials`).
5. **Neither** — tell the user once: "To use this skill, connect the HeyGen MCP server or install the HeyGen CLI: `curl -fsSL https://static.heygen.ai/cli/install.sh | bash` then `heygen auth login`."

**Hard rules:**
- **Never call `curl api.heygen.com/...`** — every mode routes through its own surface.

• Confidence: 98% confidence
• Finding: The skill recommends installing the CLI via a piped remote shell command (`curl ... | bash`). This pattern is dangerous because it executes network-fetched code immediately without integrity verification, allowing compromise if the host, CDN, DNS, or connection path is tampered with.

External Script Fetching

High

• Category: Supply Chain

Content

**CLI fallback:** If MCP tools are not available AND the `heygen` binary runs cleanly (`heygen --version` exits 0), use it. Auth: `HEYGEN_API_KEY` env OR `heygen auth login` (persists to `~/.heygen/credentials`). If the CLI is missing, errors on `--version`, or auth is not set, silently skip it — do not retry MCP.

**Neither available:** Only if MCP is unavailable AND the CLI doesn't work, tell the user once: "To use this skill, connect the HeyGen MCP server or install the HeyGen CLI: `curl -fsSL https://static.heygen.ai/cli/install.sh | bash` then `heygen auth login`."

**API:** v3 only. Never call v1 or v2 endpoints.

• Confidence: 98% confidence
• Finding: The skill recommends installing the CLI via `curl ... | bash`, which executes a remote script directly without integrity verification, pinning, or review. If the hosting domain, network path, or script content is compromised, this can lead to arbitrary code execution on the user's system.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill states Frame Check 'does NOT generate images or create new looks,' yet the framing note explicitly tells the system to use an AI Image tool for generative fill. This contradiction can cause the agent to perform undisclosed image synthesis on user likeness data, altering presenter imagery in ways the user did not authorize and broadening processing beyond the advertised function.

External Script Fetching

High

• Category: Supply Chain

Content

## Required Environment

- `HEYGEN_API_KEY` — Get from https://app.heygen.com/settings?nav=API
- `heygen` CLI — install: `curl -fsSL https://static.heygen.ai/cli/install.sh | bash`. Verify: `heygen auth status`.

## Steps

• Confidence: 97% confidence
• Finding: Piping a remotely fetched script directly into bash executes unverified code from the network with the user's privileges, creating a classic supply-chain and remote code execution risk. If the hosting domain, transport path, installer script, or upstream distribution process is compromised, an attacker can execute arbitrary commands, steal secrets such as HEYGEN_API_KEY, or establish persistence on the host.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The manifest describes a skill for creating HeyGen avatar videos and related HeyGen API workflows. This file documents an additional capability to write evaluation results to a Notion database, which is unrelated to HeyGen video generation itself and is not justified by the stated user-facing purpose of the skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The installation instructions tell users to execute a remotely fetched shell script directly with `bash` without any integrity verification, pinning, or warning about the trust and execution risk. Even if this is a common convenience pattern, it exposes users and agents to arbitrary code execution if the host, network path, or script contents are compromised.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The pasted first-run prompt encourages an agent to clone code, execute a remote install script, and handle an API key, but it does not warn about system modification, remote code execution, or credential exposure. In an agent-skill context, this is more dangerous because users may paste the prompt verbatim and authorize actions without reviewing the commands being run.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

live at:

- `https://raw.githubusercontent.com/heygen-com/skills/master/CLAUDE.md` — runtime contract for the skills
- `https://raw.githubusercontent.com/heygen-com/skills/master/SKILL.md` — top-level skill (mode detection ladder, hard rules)
- `https://raw.githubusercontent.com/heygen-com/skills/master/heygen-avatar/SKILL.md` — avatar creation sub-skill
- `https://raw.githubusercontent.com/heygen-com/skills/master/heygen-video/SKILL.md` — video generation sub-skill
- `https://raw.githubusercontent.com/heygen-com/skills/master/INSTALL.md` — human-facing install doc

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The README instructs users to paste a broad remote-install prompt into an agent: 'Read ... INSTALL_FOR_AGENTS.md and follow it. Ask me for any API keys you need.' This delegates trust to mutable remote content and gives the agent wide latitude to perform installation actions, request secrets, and choose transport automatically, which can lead to unintended invocation or overreach if the remote spec changes or the agent misinterprets the request.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README says the skill uploads a user photo, creates a persistent digital twin with a voice, and saves an avatar state file, but it does not present a clear privacy/consent warning at the point of use. Because biometric-like identity data and persistent reusable state are involved, users may not understand retention, downstream processing, or reuse risks before sensitive data leaves their machine.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The examples encourage turning articles, URLs, and PDFs into videos, which implies fetching remote content and transmitting extracted material to external services, but the README does not warn about data movement at the point those examples are introduced. This can expose confidential documents, internal URLs, or proprietary content if an agent processes them automatically.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The description centers on creating avatar videos via the 'v3 Video Agent pipeline' and replacing deprecated v1/v2 endpoints. Yet the file instructs use of broader command groups such as `heygen video {download,delete}`, `heygen user`, `heygen auth`, `heygen lipsync`, and translation operations, which go beyond the stated v3 video-agent creation purpose. These are not obviously required to fulfill the narrow producer pipeline described in the manifest.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation guidance includes phrases like "make a video of me," "record an update for my team," and "make a loom-style message," which are broad, natural requests that could easily appear in unrelated contexts. Although the description is HeyGen-focused overall, these examples are not tightly constrained and may cause unintended invocation when a user is speaking generally about video creation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest explicitly says the skill is 'NOT for: cinematic b-roll, video translation, TTS-only, or streaming avatars.' However, later documentation enumerates MCP tools and CLI commands for `create_video_translation`, `create_speech`, `video-translate`, and `voice ... speech`, which are concrete translation and speech-only capabilities. This broadens the effective behavior beyond the declared scope.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The file-access section claims no other files are accessed without explicit user instruction, yet later workflow rules require automatically reading workspace files like SOUL.md, IDENTITY.md, and AVATAR-*.md before asking the user. This mismatch can lead to unexpected access to potentially sensitive local data and undermines user consent and transparency around workspace reads.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly uploads user-provided assets to HeyGen and writes persistent local logs, but it does not provide a clear, user-facing warning about remote transfer and retention. This creates privacy and data-handling risk, especially if sensitive photos, voice samples, or identity materials are processed without explicit disclosure of where data goes and what is stored locally.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill is framed as a video-production pipeline for avatar video generation, but its CLI guidance includes `heygen user`, `heygen auth {login,logout,status}`, and `heygen video {list,download,delete}`. Authentication management and general video deletion/listing are broader account-management capabilities that are not clearly justified by the stated purpose of creating HeyGen avatar videos through the v3 pipeline.

Static analysis

No suspicious patterns detected.