Jogg Lip Sync

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill coherently uses a Jogg API key to upload user-provided media and poll lip-sync jobs, with no artifact-backed malicious behavior found.

This appears appropriate for generating Jogg lip-sync videos. Before installing, make sure you trust the source, understand that your chosen video/audio inputs may be uploaded to Jogg, and use a revocable API key where possible.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use your Jogg API account and may consume plan quota when creating lip-sync tasks.

Why it was flagged

The skill requires a Jogg API credential and uses it to authenticate API requests. This is expected for the service but gives the runner authority to create/query tasks under that account.

Skill content

`JOGG_API_KEY` is required. ... Header: `X-Api-Key: $JOGG_API_KEY`

Recommendation

Use a dedicated or revocable API key if possible, keep the key out of shared logs, and revoke it if you stop using the skill.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

Any video or audio file you provide may be uploaded to Jogg or its storage provider for processing.

Why it was flagged

The runner uploads user-supplied local media files to a signed storage URL as part of the lip-sync workflow. This is purpose-aligned, but it means selected files leave the local machine.

Skill content

`log_progress "uploading local media: $media_input"` ... `curl ... --data-binary "@$3"`

Recommendation

Only provide media you intend to upload to the Jogg service, and avoid sensitive files unless you are comfortable with Jogg processing them.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

You have less external context for verifying the publisher and reviewing updates before installation.

Why it was flagged

The registry metadata does not provide an upstream source repository or homepage, which limits independent provenance checks even though the visible behavior is coherent.

Skill content

Source: unknown; Homepage: none

Recommendation

Confirm that this skill comes from a trusted JoggAI/ClawHub source before installing, especially before providing an API key.