Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed Ofox integration for generating consent-based talking-head videos, with clear cost approval steps and no hidden persistence or exfiltration behavior found.
Before installing, confirm you are comfortable sending the portrait, script, and API request to Ofox, and only use faces you have permission to use this way. If the core skill is missing, review any npx installer command yourself first, prefer a pinned or trusted install path where available, and do not let an agent silently install skills across your agent environment.
| Identity | follows the attached frame — **measured, once**: held for 10s on job `855833b4` | generated fresh; a second job is a different person, and no flag changes that | | Across jobs | re-attach the same portrait to each job — **untested**; what was measured is one 10s clip, not two clips matching | nothing carries a photoreal person between jobs; only the words route, and it does not hold a face | | Aspect ratio | follows the attached image — **crop the portrait first**, see below | `--aspect-ratio` is yours | | Evidence | one paid run read end to end: rate, no truncation, gross lip-sync, face lock (2026-09-16) | five Ofox text-to-video jobs of 20–30s built around photoreal people, all completed — but none of them read for lip-sync | **The default is wan because the defining input is a photograph. Drop the photograph and the reason for the default drops with it** — a
No suspicious patterns detected.
