ClawHub

Dream Avatar

v1.2.1

Generate digital human talking avatar videos from images and audio using DreamAvatar 3.0 Fast API. Powered by Dreamface - AI tools for everyone. Visit https:...

⭐ 3· 456·2 current·2 all-time
byhy@hy-1990
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The name/description (DreamAvatar video generation) aligns with the runtime instructions (get upload policy, upload image/audio to OSS, call image_to_video API, poll for result). Required env var DREAM_API_KEY is appropriate. Minor provenance concern: skill source/homepage are missing (no homepage URL and source 'unknown'), so you cannot easily verify the publisher or service beyond the API domains referenced in the SKILL.md.
ℹ
Instruction Scope
SKILL.md explicitly instructs the agent to upload local image/audio files to the service's OSS (third-party storage) and to poll the remote API for results. It also includes CLI instructions that write the API key into the OpenClaw config (~/.openclaw/openclaw.json). These behaviors are expected for this functionality but have privacy implications (your files and the key are sent/stored externally). The instructions do not ask the agent to read unrelated files or other environment variables.
✓
Install Mechanism
This is an instruction-only skill with no install spec and no bundled code, so nothing is written or executed on install by the skill itself. That is the lowest-risk install profile.
ℹ
Credentials
Only DREAM_API_KEY is required and declared as the primary credential — this matches the documented API usage. Be aware the SKILL.md recommends storing the key in OpenClaw config or ~/.openclaw/openclaw.json, which persists the secret on disk; consider the security of that storage and prefer short-lived or scoped keys if possible.
✓
Persistence & Privilege
always is false and the skill does not request elevated persistent privileges or to modify other skills or system-wide settings beyond storing its own env entry. Autonomous invocation is allowed (platform default) but not a new privilege introduced by this skill.
Assessment
This skill appears to do what it says, but before installing: (1) confirm you trust the remote service (api.newportai.com / Dreamface) because local images and audio will be uploaded to third-party storage; (2) be aware the SKILL.md suggests writing your DREAM_API_KEY into OpenClaw config (~/.openclaw/openclaw.json), which persists the secret — consider using a scoped or short-lived key and protect the config file; (3) avoid uploading sensitive or private images/audio (faces, IDs, medical or legal recordings) unless you accept that they will be stored/processed externally; (4) provenance is limited (no homepage/source details), so if you need stronger assurance verify the API endpoints and vendor independently and consider revoking the API key after testing.

Like a lobster shell, security has layers — review code before you run it.

latestvk9784pp6twtv18ds3zve823xjh82mb5a

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎬 Clawdis
EnvDREAM_API_KEY
Primary envDREAM_API_KEY

Comments