WaveSpeedAI Face Swapper
v1.0.0Swap faces in images and videos using WaveSpeed AI. Supports image face swap and video face swap with multi-face targeting. Produces watermark-free results w...
⭐ 0· 334·0 current·1 all-time
byC@chengzeyi
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose (face swapping via WaveSpeed AI) matches the instructions, but the registry metadata lists no required environment variables or credentials while the SKILL.md shows the skill expects a WAVESPEED_API_KEY. The omission is incoherent: a networked image/video processing skill legitimately needs an API key and should declare it.
Instruction Scope
Runtime instructions instruct the agent to upload local image/video files and call wavespeed.run against third-party model IDs. They assume availability of a 'wavespeed' client library and the ability to access local file paths and network endpoints. The SKILL.md does not describe data retention, where uploads go beyond wavespeed.ai, or privacy/consent controls — important given sensitive face data.
Install Mechanism
This is an instruction-only skill with no install spec or code files, so nothing is written to disk by an installer. However, examples assume an npm package 'wavespeed' is present; the skill should declare dependency or provide install instructions if required.
Credentials
The SKILL.md explicitly requires WAVESPEED_API_KEY (export example) but the registry metadata declared no required env vars or primary credential. That mismatch is a red flag — the skill will need a secret to operate but the registry record doesn't surface that requirement. No other unrelated secrets are requested.
Persistence & Privilege
The skill is not set to always:true and does not request persistent system-wide privileges or modify other skills. Autonomous invocation is allowed (default) but not combined with other high-risk privileges in the manifest.
What to consider before installing
This skill's instructions require you to provide a WAVESPEED_API_KEY and to upload images/videos (sensitive personal data) to a third-party service, but the public metadata does not declare that credential—ask the publisher to clarify and correct the manifest before installing. Steps to consider before using: 1) Verify the skill's source and homepage and confirm wavespeed.ai is legitimate and its privacy/retention policy; 2) Ask the author to add required env vars and any dependency/install steps to the manifest (e.g., the 'wavespeed' npm package); 3) Don't provide your production API keys until you trust the publisher—use a limited/test key instead; 4) Be aware of legal/ethical risks from face-swapping (consent, deepfakes); 5) Test with non-sensitive images first and confirm where uploaded files are stored and who can access outputs.Like a lobster shell, security has layers — review code before you run it.
latestvk97dcwp6x78frnzp29kqn41j1s824b8t
License
MIT-0
Free to use, modify, and redistribute. No attribution required.