Ai Avatar Video

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is coherent for AI avatar video generation, but it relies on an external CLI installer, provider login, and sending media URLs to inference.sh model services.

Before installing, verify the inference.sh CLI installer and checksum source, log in only with the account you intend to use, and avoid submitting private or unauthorized portraits, voices, audio, or video links.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A changed or compromised remote installer could affect the local machine before the CLI is used.

Why it was flagged

The quick start installs the CLI by piping a remote script to a shell. This is disclosed and purpose-aligned setup, but the installer code is not part of the skill artifact.

Skill content
curl -fsSL https://cli.inference.sh | sh && infsh login
Recommendation

Review the installer source, prefer the documented manual install path, and verify checksums before running it.

What this means

The skill will operate under the inference.sh account/session that the user logs into.

Why it was flagged

The workflow includes logging into the inference.sh service, so use of a provider account is expected even though the registry metadata lists no primary credential.

Skill content
infsh login
Recommendation

Use the intended account, understand any service permissions or usage implications, and avoid sharing login tokens or session files.

What this means

When invoked, the agent can submit inference.sh CLI operations such as model listing and app runs.

Why it was flagged

The skill permits the agent to run inference.sh CLI commands. The examples are purpose-aligned, but the tool pattern is broader than the specific avatar model IDs.

Skill content
allowed-tools: Bash(infsh *)
Recommendation

Confirm inputs and model choices before running generation jobs, especially when using personal media or account-based services.

What this means

Personal portraits, voices, or video URLs may be processed by external model services.

Why it was flagged

The documented workflow sends image, audio, or video URLs to external inference.sh model apps. This is central to the skill, but the media may contain a person's likeness or voice.

Skill content
infsh app run bytedance/omnihuman-1-5 --input '{
  "image_url": "https://portrait.jpg",
  "audio_url": "https://speech.mp3"
}'
Recommendation

Only use media you are allowed to process, avoid sensitive private URLs unless intended, and review inference.sh/provider privacy and retention terms.