ClawHub
Back to skill

Security audit

Heygen Tts Tool Free

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward HeyGen text-to-speech helper, with expected external API use and no hidden persistence or destructive behavior.

Install only if you are comfortable using HeyGen's external API. Do not submit confidential, regulated, or secret text unless your organization permits it, and keep the HeyGen API key in an environment variable or other secure secret store rather than hardcoding it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
72% confidence
Finding
The skill advertises an overly broad and ambiguous trigger scope, including loosely related tasks such as translation, localization, and workflow automation. In an agent environment, this can cause the skill to be invoked for tasks beyond its narrow TTS purpose, increasing the chance of unintended network actions, mishandling user content, or surprising side effects.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs users to configure an API key and send text content to a third-party TTS provider, but it does not clearly disclose the privacy implications. Users may unknowingly transmit sensitive text or secrets to an external service, which is especially risky in an agent setting where prompts may contain confidential material.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.