v1.0.0

WaveSpeedAI Infinitetalk Talking Avatar Video Generation

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 6:16 AM.

Analysis

The skill appears to do what it claims, but using it sends portrait and audio files to WaveSpeed and requires protecting a WaveSpeed API key.

GuidanceBefore installing or using this skill, confirm you are comfortable sending the selected image and audio to WaveSpeed, have consent to generate the talking-avatar video, and keep your API key secure while monitoring usage costs.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

export WAVESPEED_API_KEY="your-api-key"

The skill requires a WaveSpeed API credential to submit generation jobs. This is expected for the provider integration, but it authorizes account usage and possibly paid model runs.

User impactIf the API key is exposed or misused, someone could consume your WaveSpeed quota or make charges on your account.

RecommendationStore the key in a secure environment or secret manager, do not hardcode it, rotate it if exposed, and monitor provider usage and billing.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

SKILL.md

const imageUrl = await wavespeed.upload("/path/to/portrait.png");
const audioUrl = await wavespeed.upload("/path/to/speech.mp3");

The core workflow uploads local portrait and speech media to WaveSpeed before generation. This is expected for the skill, but face and voice data are sensitive and leave the local environment.

User impactPersonal images or voice recordings may be processed by the external provider according to its service terms and retention practices.

RecommendationOnly upload media you have rights and consent to use, prefer trusted URLs, and review WaveSpeed's privacy, retention, and content policies before use.