Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Aliyun Emo

v1.0.0

Use when generating expressive portrait videos from a person image and speech audio with Alibaba Cloud Model Studio EMO (`emo-v1`). Use when creating non-Wan...

0· 11·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name, description, script, and prompts all align with Alibaba Cloud Model Studio EMO usage. However, SKILL.md requires a DASHSCOPE_API_KEY or a dashscope_api_key entry in ~/.alibabacloud/credentials while the skill manifest declares no required environment variables or config paths — this mismatch is unexpected and reduces trust.
!
Instruction Scope
Runtime instructions are narrowly scoped to: run a local Python script to build request JSON, call EMO detect then generate, save outputs to output/aliyun-emo, and require public HTTP/HTTPS input URLs. They also instruct the operator/agent to supply a DASHSCOPE_API_KEY or add credentials to ~/.alibabacloud/credentials. The included Python script does not access credentials itself, so the instructions implicitly expect the agent or other runtime code to use those credentials to call Alibaba APIs — but that calling behavior and exact endpoints are not shown in the skill files, making the credential requirement ambiguous.
Install Mechanism
No install spec (instruction-only plus a small helper script). Nothing is downloaded or written beyond the script producing a local JSON request; this is low-risk from an installation perspective.
!
Credentials
Asking for an Alibaba API key or adding to ~/.alibabacloud/credentials is proportionate for a cloud provider integration. However, the skill manifest declares no required env vars or config paths (none), so the undeclared DASHSCOPE_API_KEY and credential-file requirement is an inconsistency. The skill also does not declare a primary credential (even though it effectively needs one to call EMO), which is misleading.
Persistence & Privilege
The skill does not request persistent presence (always:false), does not modify other skills, and has no install steps that modify global agent configs. Autonomous invocation is allowed (platform default) but not otherwise elevated.
What to consider before installing
This skill appears to be a legitimate helper for Alibaba Cloud Model Studio EMO, and its helper script is simple and safe-looking. However, SKILL.md instructs you to provide DASHSCOPE_API_KEY or add credentials to ~/.alibabacloud/credentials, while the skill manifest reports no required environment variables or config paths — that's an inconsistency you should resolve before installing or using the skill. Before proceeding: (1) confirm with the skill author how the agent will use credentials and which exact endpoints will receive your images/audio; (2) never provide long-lived high-privilege credentials — prefer a scoped, short-lived key with minimal permissions for Model Studio; (3) if possible, run the skill in an isolated environment or sandbox first and inspect any network calls the agent makes; and (4) if you cannot verify why the manifest omitted the credential requirements, treat the skill as untrusted and do not supply your Alibaba credentials.

Like a lobster shell, security has layers — review code before you run it.

latestvk971msbjw47ayr3erp5w2wc2v9841cs7

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Category: provider

Model Studio EMO

Validation

mkdir -p output/aliyun-emo
python -m py_compile skills/ai/video/aliyun-emo/scripts/prepare_emo_request.py && echo "py_compile_ok" > output/aliyun-emo/validate.txt

Pass criteria: command exits 0 and output/aliyun-emo/validate.txt is generated.

Output And Evidence

  • Save normalized request payloads, detection boxes, and task polling snapshots under output/aliyun-emo/.
  • Record the chosen style_level and the exact face_bbox / ext_bbox.

Use EMO when the input is a portrait image and speech audio, and you need a non-Wan expressive talking-head result.

Critical model names

Use these exact model strings:

  • emo-v1-detect
  • emo-v1

Selection guidance:

  • Run image detection first to obtain face_bbox and ext_bbox.
  • Use emo-v1 only after detection succeeds.

Prerequisites

  • China mainland (Beijing) only.
  • Set DASHSCOPE_API_KEY in your environment, or add dashscope_api_key to ~/.alibabacloud/credentials.
  • Input files must be public HTTP/HTTPS URLs.

Normalized interface (video.emo)

Detect Request

  • model (string, optional): default emo-v1-detect
  • image_url (string, required)

Generate Request

  • model (string, optional): default emo-v1
  • image_url (string, required)
  • audio_url (string, required)
  • face_bbox (array<int>, required)
  • ext_bbox (array<int>, required)
  • style_level (string, optional): normal, calm, or active

Response

  • task_id (string)
  • task_status (string)
  • video_url (string, when finished)

Quick start

python skills/ai/video/aliyun-emo/scripts/prepare_emo_request.py \
  --image-url "https://example.com/portrait.png" \
  --audio-url "https://example.com/speech.mp3" \
  --face-bbox 302,286,610,593 \
  --ext-bbox 71,9,840,778 \
  --style-level active

Operational guidance

  • Do not invent face_bbox or ext_bbox; use the detection API output.
  • ext_bbox ratio determines output format: 1:1 yields 512x512, 3:4 yields 512x704.
  • Keep the input portrait clear and front-facing for better expression quality.
  • EMO is portrait-focused; for full-scene human videos use other skills instead.

Output location

  • Default output: output/aliyun-emo/request.json
  • Override base dir with OUTPUT_DIR.

References

  • references/sources.md

Files

4 total
Select a file
Select a file to preview.

Comments

Loading comments…