Hg Skills Republish 221

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:03 AM UTC
• Version: 2.2.1

Overview

This HeyGen video skill is mostly purpose-aligned, but its install and data-handling instructions give agents too much unsafeguarded authority.

Review before installing. Prefer MCP OAuth where possible, do not paste broad install prompts that let an agent 'do the rest,' avoid curl-to-bash installers unless you independently trust and verify them, pin and verify any OpenClaw plugin, keep API keys out of global shell profiles when possible, and approve each raw file/photo upload to HeyGen explicitly.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:48

Finding

Unverified Remote Installer Is Piped Directly into Bash

Content

View full analysis

Remediation

View remediation

heygen-cli.tar.gz" | sha256sum -c - ``` 5. Require the user to inspect or explicitly approve the verified artifact before installation. 6. Document the files, directories, and permissions the installer will modify. 7. Prefer a reputable package manager with pinned versions and package-signature verification. 8. If an installer script remains available, download it to disk and verify its signature before running it; never execute the network stream directly. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:13

Finding

Mutable Remote Installation Instructions Are Treated as Authoritative Agent Commands

Content

View full analysis

Remediation

View remediation

/INSTALL_FOR_AGENTS.md ``` 4. Publish and verify a digest or signature for remotely retrieved instruction files. 5. Separate documentation retrieval from command execution. The agent should display proposed commands and obtain explicit approval before running them. 6. Never give remotely retrieved text blanket authorization to request or handle secrets. 7. Constrain installation actions to a documented allowlist of paths and commands. 8. Require renewed review and user approval whenever the pinned installation specification changes. ]]>

T08 · Insecure Dependencies

Error

• Location: INSTALL_FOR_AGENTS.md:125

Finding

Unpinned OpenClaw Plugin Is Installed with Access to the API Key

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: INSTALL_FOR_AGENTS.md:89

Finding

Long-Lived API Key Is Stored in Plaintext Shell Startup Files

Content

View full analysis

``` ```text To persist across sessions, add `export HEYGEN_API_KEY=` to your shell profile (`~/.zshrc`, `~/.bashrc`, or equivalent). ``` ### Technical Analysis Shell startup files are not dedicated secret stores. They are frequently copied into dotfile repositories, included in diagnostics and backups, read by unrelated interactive shells, or exposed through accidental terminal output. Environment variables are also inherited by child processes, broadening credential exposure beyond the HeyGen CLI. A project-local `.env` file creates an additional source-control disclosure risk. Merely warning the user not to commit it does not enforce restrictive permissions, ignore rules, redaction, or secret scanning. The API key authorizes separately billed API usage, so disclosure can produce direct financial impact. ### Attack Path 1. The user or agent writes `HEYGEN_API_KEY` into `.zshrc`, `.bashrc`, or `.env`. 2. A local process, debugging tool, backup product, support bundle, shell-history workflow, or dotfile synchronization reads the plaintext value. 3. Alternatively, a project-local `.env` file is accidentally committed or uploaded. 4. An attacker retrieves the key. 5. The attacker uses the key for unaut ...[truncated 600 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/asset-routing.md:22

Finding

Ambiguous Local Files Default to Full Third-Party Upload Without Explicit Consent

Content

View full analysis

500 words) → summarize key points, attach full doc ``` Path B is defined as transmitting the raw file: ```text | **B: Attach to API** | Upload the raw file via `files[]`. Video Agent analyzes, extracts graphics, uses as frames/B-roll. | | **A+B: Both** | Contextualize for script quality AND attach for visual use. | ``` The mandatory routing rules reinforce the upload default: ```text - **Never ask the user which path unless genuinely 50/50.** You're the producer. Make the call. - **When in doubt, do both (A+B).** Over-providing costs nothing. ``` The documented upload operation is: ```bash heygen asset create --file /path/to/file.png ``` ### Technical Analysis Providing a file to an agent for local summarization or contextual analysis does not necessarily authorize transmission of the complete file to HeyGen. The routing logic defaults ambiguous cases to A+B, where the raw file is uploaded, and instructs the agent not to ask the user unless the decision is exactly balanced. The statement that “over-providing costs nothing” disregards confidentiality, personal-data exposure, third-party retention, contractual restrictions, and data-minimization requirements. For contextual documents, Path A can satisfy the declared task without sending the full original. The root Skill states that assets are uploaded when users explicitly provide them “ ...[truncated 1354 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (61)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

curl ... | bash is a direct remote code execution pattern: content retrieved at runtime from an external server is immediately executed by the shell. If the remote server, DNS, TLS termination, CDN path, or script distribution process is compromised, an attacker can run arbitrary commands on the user's machine or agent host.

Content

Scanner excerpt · INSTALL.md (reported line 41)May include surrounding context.

CLI with API key (recommended for agents):

bash

curl -fsSL https://static.heygen.ai/cli/install.sh | bash
export HEYGEN_API_KEY=<your-key>
heygen --version        # verify binary is on PATH
heygen auth status      # verify auth

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The | bash chaining construct suppresses the opportunity to inspect downloaded content before execution and is a classic unsafe bootstrap mechanism. In a skill installation document, this pattern normalizes blind trust of remote code and can be exploited for full command execution on the target environment.

Content

Scanner excerpt · INSTALL.md (reported line 41)May include surrounding context.

CLI with API key (recommended for agents):

bash

curl -fsSL https://static.heygen.ai/cli/install.sh | bash
export HEYGEN_API_KEY=<your-key>
heygen --version        # verify binary is on PATH
heygen auth status      # verify auth

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The same external-script execution pattern appears inside a copy-paste prompt intended for an agent, which increases the chance of blind execution. In this context the risk is amplified because an autonomous or semi-autonomous agent may perform the command with minimal user scrutiny, leading to arbitrary code execution and possible credential access on the host.

Content

Scanner excerpt · INSTALL.md (reported line 55)May include surrounding context.

md

Paste this prompt to your agent — it will find the right paths automatically:

> Install the HeyGen Skills from https://github.com/heygen-com/skills.git — clone it into your skills directory (find it with your config or ask if unsure). Install the HeyGen CLI via `curl -fsSL https://static.heygen.ai/cli/install.sh | bash` and export HEYGEN_API_KEY=\<your-key\> (get one at https://app.heygen.com/api). Or, if you're on a HeyGen plan and already have MCP connected to your agent, skip the key step — MCP will be used automatically. Then use the heygen-avatar skill to create an avatar for me, and heygen-video to make a 30-60 second intro video, casual tone.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The guide instructs agents/users to execute a remote install script directly from the network via curl piped to bash, which gives the remote server immediate code execution on the host without prior verification. If the hosting domain, transport, or script content is compromised, an attacker could run arbitrary commands, steal credentials, alter configs, or install persistence.

Content

Scanner excerpt · INSTALL_FOR_AGENTS.md (reported line 155)May include surrounding context.

Option B: HeyGen CLI (works with any agent that can shell out)

bash

curl -fsSL https://static.heygen.ai/cli/install.sh | bash

Then sign in:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The shell pipeline chaining remote content directly into bash removes any opportunity for inspection and amplifies the risk of arbitrary code execution from untrusted or tampered content. In an agent-install context this is especially dangerous because the command may be run with the user's privileges and in an environment that holds API keys, PATH settings, and other sensitive configuration.

Content

Scanner excerpt · INSTALL_FOR_AGENTS.md (reported line 155)May include surrounding context.

Option B: HeyGen CLI (works with any agent that can shell out)

bash

curl -fsSL https://static.heygen.ai/cli/install.sh | bash

Then sign in:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The command pipes a remotely fetched shell script directly into bash, which executes unreviewed code from the network without integrity verification. If the hosting domain, TLS trust chain, CDN path, or upstream script is compromised, users could suffer arbitrary code execution on their machine during installation.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

One-line install (macOS / Linux):

bash

curl -fsSL https://static.heygen.ai/cli/install.sh | bash

Then set your API key:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The '| bash' construct is a classic chaining-abuse pattern because it combines retrieval and execution in one step, eliminating any review boundary. In an agent-skill context this is more dangerous, since an agent may execute the pipeline automatically or recommend it to users, amplifying the risk of remote code execution from a single prompt.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

One-line install (macOS / Linux):

bash

curl -fsSL https://static.heygen.ai/cli/install.sh | bash

Then set your API key:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The code's primary purpose is entirely different from the declared description. Nothing in the script interacts with api.heygen.com, creates videos, manages avatars, performs prompt engineering, corrects aspect ratios, or selects voices. Instead, it implements periodic version checking for the skill package itself using local files and a remote GitHub-hosted VERSION file. This is a clear description-behavior mismatch, not merely a supporting detail.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill recommends installing the CLI via a piped remote shell command (curl ... | bash). This pattern is dangerous because it executes network-fetched code immediately without integrity verification, allowing compromise if the host, CDN, DNS, or connection path is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

2. **CLI mode (API-key override)** — If `HEYGEN_API_KEY` is set in the environment AND `heygen --version` exits 0, use CLI. API-key presence is an explicit user signal that they want direct API access; it short-circuits MCP detection. No question asked.
3. **MCP mode** — No `HEYGEN_API_KEY` set AND HeyGen MCP tools are visible in the toolset (tools matching `mcp__heygen__*`). OAuth auth, uses existing plan credits.
4. **CLI mode (fallback)** — MCP tools NOT available AND `heygen --version` exits 0. Auth via `heygen auth login` (persists to `~/.heygen/credentials`).
5. **Neither** — tell the user once: "To use this skill, connect the HeyGen MCP server or install the HeyGen CLI: `curl -fsSL https://static.heygen.ai/cli/install.sh | bash` then `heygen auth login`."

**Hard rules:**
- **Never call `curl api.heygen.com/...`** — every mode routes through its own surface.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill recommends installing the CLI via curl ... | bash, which executes a remote script directly without integrity verification, pinning, or review. If the hosting domain, network path, or script content is compromised, this can lead to arbitrary code execution on the user's system.

Content

Scanner excerpt · heygen-avatar/SKILL.md (reported line 58)May include surrounding context.

md

**CLI fallback:** If MCP tools are not available AND the `heygen` binary runs cleanly (`heygen --version` exits 0), use it. Auth: `HEYGEN_API_KEY` env OR `heygen auth login` (persists to `~/.heygen/credentials`). If the CLI is missing, errors on `--version`, or auth is not set, silently skip it — do not retry MCP.

**Neither available:** Only if MCP is unavailable AND the CLI doesn't work, tell the user once: "To use this skill, connect the HeyGen MCP server or install the HeyGen CLI: `curl -fsSL https://static.heygen.ai/cli/install.sh | bash` then `heygen auth login`."

**API:** v3 only. Never call v1 or v2 endpoints.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill states Frame Check 'does NOT generate images or create new looks,' yet the framing note explicitly tells the system to use an AI Image tool for generative fill. This contradiction can cause the agent to perform undisclosed image synthesis on user likeness data, altering presenter imagery in ways the user did not authorize and broadening processing beyond the advertised function.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Piping a remotely fetched script directly into bash executes unverified code from the network with the user's privileges, creating a classic supply-chain and remote code execution risk. If the hosting domain, transport path, installer script, or upstream distribution process is compromised, an attacker can execute arbitrary commands, steal secrets such as HEYGEN_API_KEY, or establish persistence on the host.

Content

Scanner excerpt · platforms/nanoclaw/heygen/SKILL.md (reported line 14)May include surrounding context.

md

## Required Environment

- `HEYGEN_API_KEY` — Get from https://app.heygen.com/settings?nav=API
- `heygen` CLI — install: `curl -fsSL https://static.heygen.ai/cli/install.sh | bash`. Verify: `heygen auth status`.

## Steps

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a skill for creating HeyGen avatar videos and related HeyGen API workflows. This file documents an additional capability to write evaluation results to a Notion database, which is unrelated to HeyGen video generation itself and is not justified by the stated user-facing purpose of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The installation instructions tell users to execute a remotely fetched shell script directly with bash without any integrity verification, pinning, or warning about the trust and execution risk. Even if this is a common convenience pattern, it exposes users and agents to arbitrary code execution if the host, network path, or script contents are compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The pasted first-run prompt encourages an agent to clone code, execute a remote install script, and handle an API key, but it does not warn about system modification, remote code execution, or credential exposure. In an agent-skill context, this is more dangerous because users may paste the prompt verbatim and authorize actions without reviewing the commands being run.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · INSTALL_FOR_AGENTS.md (reported line 20)May include surrounding context.

md

live at:

- `https://raw.githubusercontent.com/heygen-com/skills/master/CLAUDE.md` — runtime contract for the skills
- `https://raw.githubusercontent.com/heygen-com/skills/master/SKILL.md` — top-level skill (mode detection ladder, hard rules)
- `https://raw.githubusercontent.com/heygen-com/skills/master/heygen-avatar/SKILL.md` — avatar creation sub-skill
- `https://raw.githubusercontent.com/heygen-com/skills/master/heygen-video/SKILL.md` — video generation sub-skill
- `https://raw.githubusercontent.com/heygen-com/skills/master/INSTALL.md` — human-facing install doc

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to paste a broad remote-install prompt into an agent: 'Read ... INSTALL_FOR_AGENTS.md and follow it. Ask me for any API keys you need.' This delegates trust to mutable remote content and gives the agent wide latitude to perform installation actions, request secrets, and choose transport automatically, which can lead to unintended invocation or overreach if the remote spec changes or the agent misinterprets the request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README says the skill uploads a user photo, creates a persistent digital twin with a voice, and saves an avatar state file, but it does not present a clear privacy/consent warning at the point of use. Because biometric-like identity data and persistent reusable state are involved, users may not understand retention, downstream processing, or reuse risks before sensitive data leaves their machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The examples encourage turning articles, URLs, and PDFs into videos, which implies fetching remote content and transmitting extracted material to external services, but the README does not warn about data movement at the point those examples are introduced. This can expose confidential documents, internal URLs, or proprietary content if an agent processes them automatically.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description centers on creating avatar videos via the 'v3 Video Agent pipeline' and replacing deprecated v1/v2 endpoints. Yet the file instructs use of broader command groups such as heygen video {download,delete}, heygen user, heygen auth, heygen lipsync, and translation operations, which go beyond the stated v3 video-agent creation purpose. These are not obviously required to fulfill the narrow producer pipeline described in the manifest.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation guidance includes phrases like "make a video of me," "record an update for my team," and "make a loom-style message," which are broad, natural requests that could easily appear in unrelated contexts. Although the description is HeyGen-focused overall, these examples are not tightly constrained and may cause unintended invocation when a user is speaking generally about video creation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest explicitly says the skill is 'NOT for: cinematic b-roll, video translation, TTS-only, or streaming avatars.' However, later documentation enumerates MCP tools and CLI commands for create_video_translation, create_speech, video-translate, and voice ... speech, which are concrete translation and speech-only capabilities. This broadens the effective behavior beyond the declared scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file-access section claims no other files are accessed without explicit user instruction, yet later workflow rules require automatically reading workspace files like SOUL.md, IDENTITY.md, and AVATAR-*.md before asking the user. This mismatch can lead to unexpected access to potentially sensitive local data and undermines user consent and transparency around workspace reads.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly uploads user-provided assets to HeyGen and writes persistent local logs, but it does not provide a clear, user-facing warning about remote transfer and retention. This creates privacy and data-handling risk, especially if sensitive photos, voice samples, or identity materials are processed without explicit disclosure of where data goes and what is stored locally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is framed as a video-production pipeline for avatar video generation, but its CLI guidance includes heygen user, heygen auth {login,logout,status}, and heygen video {list,download,delete}. Authentication management and general video deletion/listing are broader account-management capabilities that are not clearly justified by the stated purpose of creating HeyGen avatar videos through the v3 pipeline.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.