Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Face Swap
v1.0.0Guide users to VideoAny Face Swap tool to create AI face swap videos from a source video and face image.
⭐ 0· 105·0 current·0 all-time
byColin@gaoq1
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description align with included files and behavior: scripts only print guidance and point users to https://videoany.io/face-swap. No unexpected credentials, binaries, or cloud access are requested.
Instruction Scope
SKILL.md instructs the agent to guide users to the VideoAny web page and to use the local CLI only as a helper. The CLI scripts accept local file paths but do not read or transmit file contents. However the frontmatter declares permission 'shell:exec' which is broader than needed by the provided scripts and grants the agent the ability to run arbitrary shell commands — this is unnecessary for the stated purpose and increases risk.
Install Mechanism
No install spec; the skill is instruction-only with small Python helper scripts and no external dependencies. Nothing is downloaded or written to disk by an install step.
Credentials
The skill requests no environment variables or credentials and the code does not reference any environment secrets or external config paths.
Persistence & Privilege
Skill is not always-included and uses default autonomous invocation. It does not request persistent system-wide changes or configuration of other skills.
What to consider before installing
What to consider before installing:
- Functionally this is a small guidance skill that prints instructions and directs users to VideoAny for actual generation; the code matches that purpose.
- The skill's frontmatter requests 'shell:exec' permission even though the included scripts only print guidance; consider removing that permission or requiring explicit confirmation before allowing shell execution. Granting shell execution expands what the agent could do beyond simple guidance.
- _meta.json contains an ownerId that differs from the registry metadata; this may be a benign packaging oversight but could also indicate the package was copied/modified—verify the source and provenance if you need trust guarantees.
- The skill points users to a third-party site for uploads: uploading face images and videos carries privacy and legal risk. Confirm you have rights to any media you upload and review VideoAny's terms/privacy before use.
- If you plan to install, review the short Python scripts yourself (they are small and readable) and remove unnecessary permissions. If you need higher assurance, ask the publisher for an authoritative homepage or source repository to verify provenance.Like a lobster shell, security has layers — review code before you run it.
latestvk977hn7cgz8zjsv0rdqax6zcj5835c80
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
