OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Pass3 providerslatest audit Jul 16, 2026
Independent checks from skills.sh's audit partners.
The skill describes a rendering mechanism for video transitions that involves injecting and executing JavaScript templates. While this is the intended functionality for the 'heygen-com' vendor, the process of interpolating placeholders into executable code without strict whitelisting on the master timeline creates a surface for potential indirect code or prompt injection.
Detected behaviors
No alerts
No issues