Security audit
Security checks across malware telemetry and agentic risk
This is a legitimate but deprecated HeyGen video-generation skill that sends user-chosen prompts, media, and account actions to HeyGen, with no hidden installer or malicious behavior found.
Prefer the newer create-video or avatar-video skills when possible. Install this legacy skill only if you are comfortable giving an agent HeyGen API access; review prompts, portraits, uploaded files, recipient data, remote asset URLs, webhook destinations, and delete requests before use, and require webhook signature verification in real deployments.
const buffer = Buffer.from(await sourceResponse.arrayBuffer());
// 2. Upload directly to HeyGen
const response = await fetch("https://upload.heygen.com/v1/asset", {
method: "POST",
headers: {
"X-Api-Key": process.env.HEYGEN_API_KEY!,): Promise<string> {
const dimension = DIMENSIONS[preset];
const response = await fetch("https://api.heygen.com/v2/video/generate", {
method: "POST",
headers: {
"X-Api-Key": process.env.HEYGEN_API_KEY!,): Promise<string> {
const { style = "normal", backgroundColor = "#1a1a2e" } = options;
const response = await fetch("https://api.heygen.com/v2/video/generate", {
method: "POST",
headers: {
"X-Api-Key": process.env.HEYGEN_API_KEY!,): Promise<string> {
const dimension = DIMENSIONS[preset];
const response = await fetch("https://api.heygen.com/v2/video/generate", {
method: "POST",
headers: {
"X-Api-Key": process.env.HEYGEN_API_KEY!,): Promise<string> {
const { style = "normal", backgroundColor = "#1a1a2e" } = options;
const response = await fetch("https://api.heygen.com/v2/video/generate", {
method: "POST",
headers: {
"X-Api-Key": process.env.HEYGEN_API_KEY!,67/67 vendors flagged this skill as clean.
No suspicious patterns detected.