IceCube Avatar Clone

PassAudited by ClawScan on May 10, 2026.

Overview

This is an instruction-only avatar-generation guide; it is coherent, but users should be aware that real use may involve API keys, paid third-party services, and face or voice uploads.

This skill appears safe to install as an instruction-only guide. Before acting on it, confirm costs, protect any API keys, review HeyGen/D-ID privacy terms, and use only authorized photos, videos, and voices with clear AI-generated labeling.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Using the API example with a real account could spend credits or create account content.

Why it was flagged

The guide provides a purpose-aligned API example for generating a HeyGen video. If a user or agent adapted it with real credentials, it could create videos and consume provider credits, so explicit user confirmation is appropriate.

Skill content

requests.post("https://api.heygen.com/v2/video/generate" ... )

Recommendation

Only run provider API calls after the user confirms the account, cost, input media, and intended output.

Low

#ASI03: Identity and Privilege Abuse

What this means

A real API key may allow video generation and account usage under the user's provider account.

Why it was flagged

The skill shows use of a HeyGen API key placeholder. This is expected for the service integration and no hardcoded secret or unrelated credential use is present, but it still grants account authority.

Skill content

headers={"X-Api-Key": "YOUR_API_KEY"}

Recommendation

Use only the intended provider key, keep it secret, avoid pasting it into shared logs or prompts, and consider using the least-privileged key available.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Photos, videos, voice audio, and scripts may be processed by external providers with their own privacy, retention, and consent rules.

Why it was flagged

The documented workflow involves sending photos, recorded video, text, or audio to third-party avatar services. This is central to the skill's purpose and disclosed, but face and voice media are sensitive.

Skill content

流程：
1. 上传照片或录制视频
2. 创建 Avatar（数字人形象）
3. 输入文字或上传音频
4. 生成视频

Recommendation

Upload only media you have rights to use, review the provider privacy terms, and avoid sending sensitive or unauthorized likeness or voice data.