Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ai Avatar Video

v0.1.5

Create AI avatar and talking head videos with OmniHuman, Fabric, PixVerse via inference.sh CLI. Models: OmniHuman 1.5, OmniHuman 1.0, Fabric 1.0, PixVerse Li...

0· 1.2k·5 current·5 all-time
byÖmer Karışman@okaris
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (AI avatar & talking head videos) align with the runtime instructions: all examples invoke the inference.sh CLI (infsh) to run named avatar apps. Listed models and workflows are consistent with the stated capability.
!
Instruction Scope
The SKILL.md tells users to run `curl -fsSL https://cli.inference.sh | sh && infsh login` and then `infsh app run ...` with image/audio URLs. This stays within the avatar/video generation scope, but the instructions implicitly cause: (1) execution of a remote install script, (2) an interactive login flow that will obtain credentials/tokens (not declared), and (3) uploading or referencing user media (images/audio) to a third-party service. The file/network actions and credential acquisition are not surfaced in requires.env and should be made explicit.
!
Install Mechanism
There is no packaged install spec in the registry entry; the README advocates piping a remote shell script from https://cli.inference.sh (download-and-exec). While the doc claims the installer verifies SHA-256 checksums hosted at dist.inference.sh, the provided one-liner does not show any local checksum verification prior to execution. Download-and-exec from an external URL raises a higher risk profile unless the user manually verifies the binary and checksums beforehand.
Credentials
The skill declares no required environment variables or primary credential, which is plausible for an instruction-only wrapper. However, it instructs `infsh login` (implying account credentials or API tokens) and uses remote services to process user media; those credential/access implications are not declared. Users should assume credentials/tokens will be created/used and that media will be transmitted to inference.sh backend services.
Persistence & Privilege
The skill does not request always:true, does not include install scripts in the package, and does not claim to modify other skills or system-wide settings. Its persistence footprint depends on whether the user runs the installer; that action is initiated by the user, not forced by the skill.
What to consider before installing
This skill appears to be what it says (it uses the inference.sh CLI to run avatar models), but exercise caution before installing: (1) avoid blindly running `curl | sh` — instead download the installer, verify the SHA-256 checksums from the linked checksums.txt, and inspect the installer script if possible; (2) understand that `infsh login` will create/use credentials or tokens (not listed in the skill) — review the CLI's auth/storage behavior and revoke tokens you don't trust; (3) media you provide (images/audio/video URLs) will be sent to the provider's servers — check their privacy/terms if data sensitivity matters; (4) if you want lower risk, prefer running these tools in an isolated sandbox or VM and review the CLI source/release artifacts on the provider's site before executing.

Like a lobster shell, security has layers — review code before you run it.

latestvk974pvrbwfmmrp1pd5fw69ztbx81dh6b
1.2kdownloads
0stars
2versions
Updated 4m ago
v0.1.5
MIT-0

AI Avatar & Talking Head Videos

Create AI avatars and talking head videos via inference.sh CLI.

AI Avatar & Talking Head Videos

Quick Start

curl -fsSL https://cli.inference.sh | sh && infsh login

# Create avatar video from image + audio
infsh app run bytedance/omnihuman-1-5 --input '{
  "image_url": "https://portrait.jpg",
  "audio_url": "https://speech.mp3"
}'

Install note: The install script only detects your OS/architecture, downloads the matching binary from dist.inference.sh, and verifies its SHA-256 checksum. No elevated permissions or background processes. Manual install & verification available.

Available Models

ModelApp IDBest For
OmniHuman 1.5bytedance/omnihuman-1-5Multi-character, best quality
OmniHuman 1.0bytedance/omnihuman-1-0Single character
Fabric 1.0falai/fabric-1-0Image talks with lipsync
PixVerse Lipsyncfalai/pixverse-lipsyncHighly realistic

Search Avatar Apps

infsh app list --search "omnihuman"
infsh app list --search "lipsync"
infsh app list --search "fabric"

Examples

OmniHuman 1.5 (Multi-Character)

infsh app run bytedance/omnihuman-1-5 --input '{
  "image_url": "https://portrait.jpg",
  "audio_url": "https://speech.mp3"
}'

Supports specifying which character to drive in multi-person images.

Fabric 1.0 (Image Talks)

infsh app run falai/fabric-1-0 --input '{
  "image_url": "https://face.jpg",
  "audio_url": "https://audio.mp3"
}'

PixVerse Lipsync

infsh app run falai/pixverse-lipsync --input '{
  "image_url": "https://portrait.jpg",
  "audio_url": "https://speech.mp3"
}'

Generates highly realistic lipsync from any audio.

Full Workflow: TTS + Avatar

# 1. Generate speech from text
infsh app run infsh/kokoro-tts --input '{
  "text": "Welcome to our product demo. Today I will show you..."
}' > speech.json

# 2. Create avatar video with the speech
infsh app run bytedance/omnihuman-1-5 --input '{
  "image_url": "https://presenter-photo.jpg",
  "audio_url": "<audio-url-from-step-1>"
}'

Full Workflow: Dub Video in Another Language

# 1. Transcribe original video
infsh app run infsh/fast-whisper-large-v3 --input '{"audio_url": "https://video.mp4"}' > transcript.json

# 2. Translate text (manually or with an LLM)

# 3. Generate speech in new language
infsh app run infsh/kokoro-tts --input '{"text": "<translated-text>"}' > new_speech.json

# 4. Lipsync the original video with new audio
infsh app run infsh/latentsync-1-6 --input '{
  "video_url": "https://original-video.mp4",
  "audio_url": "<new-audio-url>"
}'

Use Cases

  • Marketing: Product demos with AI presenter
  • Education: Course videos, explainers
  • Localization: Dub content in multiple languages
  • Social Media: Consistent virtual influencer
  • Corporate: Training videos, announcements

Tips

  • Use high-quality portrait photos (front-facing, good lighting)
  • Audio should be clear with minimal background noise
  • OmniHuman 1.5 supports multiple people in one image
  • LatentSync is best for syncing existing videos to new audio

Related Skills

# Full platform skill (all 150+ apps)
npx skills add inference-sh/skills@inference-sh

# Text-to-speech (generate audio for avatars)
npx skills add inference-sh/skills@text-to-speech

# Speech-to-text (transcribe for dubbing)
npx skills add inference-sh/skills@speech-to-text

# Video generation
npx skills add inference-sh/skills@ai-video-generation

# Image generation (create avatar images)
npx skills add inference-sh/skills@ai-image-generation

Browse all video apps: infsh app list --category video

Documentation

Comments

Loading comments...