Heygen Ai

• Analyzed: Apr 10, 2026, 8:31 PM
• Findings: 1
• Version: 1.0.0
• Hash: e4e0bb41bd70f99ebf040bf264ac677a61c1a122490954016ec2a1f83b44b159
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill exhibits brand impersonation, claiming to be 'HeyGen AI' while directing all API traffic to an unrelated domain (nemovideo.ai). It includes instructions for the agent to fingerprint the user's environment by checking installation paths (e.g., `~/.cursor/skills/`) and requests access to local configuration directories (`~/.config/nemovideo/`). While the core functionality appears to be a video generation wrapper, the deceptive naming and environment probing are significant indicators of suspicious intent. IOC: mega-api-prod.nemovideo.ai.