Dream LipSync
v1.0.5Video lip synchronization using LipSync 2.0 API. Automatically synchronizes audio with lip movements in videos. Powered by Dreamface - AI tools for everyone....
⭐ 1· 339·0 current·0 all-time
byhy@hy-1990
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name and description (LipSync 2.0) align with the declared requirement (DREAMLIPSYNC_API_KEY) and the SKILL.md describes the expected API endpoints. Minor inconsistency: public branding links reference Dreamface/dreamfaceapp.com while the API endpoints use api.newportai.com; this can be legitimate but worth verifying the provider relationship.
Instruction Scope
Instructions require uploading local files to a provider OSS host (dreamapi-oss.oss-cn-hongkong.aliyuncs.com) and then calling async API endpoints. That means user video/audio files will be transmitted to the external storage/service; if you plan to process sensitive media this is a privacy risk. Otherwise instructions are narrowly scoped to file upload, task creation, and polling — no unrelated system files or extra env vars are referenced.
Install Mechanism
No install spec or code is included (instruction-only). This minimizes local installation risk because nothing is downloaded or executed by the skill itself.
Credentials
Only one credential is required (DREAMLIPSYNC_API_KEY), which is appropriate for an API service. Keep in mind the API key grants the skill access to the provider account (task creation, file access) so treat it as sensitive and scope/rotate appropriately.
Persistence & Privilege
Skill is not always-enabled and does not request elevated platform privileges. The SKILL.md shows an example openclaw config patch to store the API key in agent config; storing its own credential is normal but you should ensure the agent stores credentials securely.
Assessment
This skill appears to do what it says, but before installing: 1) Verify the API provider (api.newportai.com vs dreamfaceapp.com) and review their privacy/security policy. 2) Understand that local videos/audio are uploaded to a third‑party OSS endpoint (dreamapi-oss.oss-cn-hongkong.aliyuncs.com) — do not upload sensitive or private media unless you trust the provider. 3) Protect the DREAMLIPSYNC_API_KEY: only grant least privilege, rotate if exposed, and prefer a test key for initial trials. 4) The package has no code (instruction-only), so risks are limited to network/data disclosure; test with non-sensitive files first. 5) If you need higher assurance, ask the publisher for official docs or a homepage and confirm the relationship between Dreamface and NewportAI.Like a lobster shell, security has layers — review code before you run it.
latestvk977nga7hp8dr0rgapf7jm4cxs83jd8h
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎤 Clawdis
EnvDREAMLIPSYNC_API_KEY
Primary envDREAMLIPSYNC_API_KEY