ClawHub
Back to skill

Security audit

HeyGen TTS免费版

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a HeyGen cloud text-to-speech helper, but its broad activation language and limited privacy/file-safety guidance warrant review before installation.

Install this only if you intend to use HeyGen's cloud service for TTS. Treat the API key as a secret, avoid submitting confidential or regulated text unless third-party processing is approved, and specify safe output paths so generated audio does not overwrite important files. Use it for speech generation rather than unrelated translation, data, or automation tasks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Vague Triggers

Medium
Confidence
71% confidence
Finding
The activation scope is excessively broad and includes generic keywords such as language, data, api, and workflow-oriented phrasing, which can cause the agent to invoke this skill outside its intended TTS-only context. In a skill with read/exec/write permissions, overbroad routing increases the chance of unintended external calls, file operations, or handling of sensitive text under the wrong tool.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The skill describes exporting, saving, downloading, and writing files, while the manifest grants write and exec capabilities, but it does not clearly warn that local files may be created or overwritten. This increases the risk of unintended filesystem modification, especially if an agent interprets 'save' or 'export' autonomously.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill instructs users to load an API key from environment variables and send it to a third-party service without an explicit warning about credential sensitivity, third-party data exposure, or safe secret-handling practices. In an agent context, this omission can normalize transmitting secrets and user content externally without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
# ...
def generate_speech(text, voice_id, language="en", speed=1.0):
    """生成语音"""
    response = requests.post(
        "https://api.heygen.com/v3/voices/speech",
        headers={
            "X-Api-Key": os.environ["HEYGEN_API_KEY"],
Confidence
84% confidence
Finding
The request posts data to an external service endpoint, which creates a real data-exposure boundary even though it is the intended product behavior. In the skill context, the danger comes from potential forwarding of confidential text and linkage with an API key, not from the mere existence of network access.

External Transmission

Medium
Category
Data Exfiltration
Content
# ...
def generate_speech(text, voice_id, language="en", speed=1.0):
    """生成语音"""
    response = requests.post(
        "https://api.heygen.com/v3/voices/speech",
        headers={
            "X-Api-Key": os.environ["HEYGEN_API_KEY"],
Confidence
84% confidence
Finding
The request posts data to an external service endpoint, which creates a real data-exposure boundary even though it is the intended product behavior. In the skill context, the danger comes from potential forwarding of confidential text and linkage with an API key, not from the mere existence of network access.

External Transmission

Medium
Category
Data Exfiltration
Content
-H "X-Api-Key: $HEYGEN_API_KEY"
# ...
# 生成中文语音
curl -X POST "https://api.heygen.com/v3/voices/speech" \
  -H "X-Api-Key: $HEYGEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
82% confidence
Finding
The curl example sends content and authentication material to HeyGen over the network. That is normal for a cloud TTS skill, but it becomes a genuine security concern if users are not warned that their text leaves the local environment and may include sensitive material.

External Transmission

Medium
Category
Data Exfiltration
Content
def generate_speech(text, voice_id, language="en", speed=1.0):
    """生成语音"""
    response = requests.post(
        "https://api.heygen.com/v3/voices/speech",
        headers={
            "X-Api-Key": os.environ["HEYGEN_API_KEY"],
            "Content-Type": "application/json",
Confidence
82% confidence
Finding
This explicitly targets a third-party API domain for speech generation, confirming outbound transmission of user text and credential-bearing requests. In an agent skill, unguarded external submission can expose proprietary or personal data when the user expects local processing.

External Transmission

Medium
Category
Data Exfiltration
Content
class HeyGenTTS:
    def __init__(self, api_key=None):
        self.api_key = api_key or os.environ["HEYGEN_API_KEY"]
        self.base_url = "https://api.heygen.com/v3"
# ...
    def list_voices(self, language=None, gender=None):
        """查询语音列表"""
Confidence
80% confidence
Finding
The reusable client class centralizes outbound access to HeyGen's API, which is legitimate functionality but still represents a data egress mechanism. The broader risk is that this abstraction makes repeated remote transmission easier without forcing per-request acknowledgement of privacy or sensitivity concerns.

Static analysis

No suspicious patterns detected.