Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent for creating avatar videos, but its setup asks users to execute a mutable remote installer and optional unpinned skill installs.
Review before installing. Prefer a pinned, inspectable CLI download with independent checksum or signature verification, run login separately, and avoid submitting private face, voice, or video media unless you understand the provider's handling and have consent from people depicted or recorded.
SKILL.md:16Remote Installer Is Executed Directly Without Local Verification
SKILL.md:127Related Skills Are Installed Through Unpinned Third-Party Dependencies
curl -fsSL https://cli.inference.sh | sh executes a remotely fetched script directly in the user's shell, creating a classic supply-chain and remote code execution risk if the server, CDN, DNS, TLS termination, or script distribution path is compromised. The nearby reassurance text lowers user skepticism, which makes the pattern more dangerous because it encourages immediate execution of unreviewed network-delivered code.
curl -fsSL https://cli.inference.sh | sh && infsh login
# Create avatar video from image + audio
infsh app run bytedance/omnihuman-1-5 --input '{
The manifest description advertises activation triggers such as "ai avatar," "talking head," "lipsync," and "avatar video" without any narrowing context, exclusions, or negative examples. Several of these are generic content-creation phrases, which increases the risk of unintended invocation when a user is discussing media tasks more generally.
The skill repeatedly instructs users to provide image, audio, and video URLs to remote infsh app run services, but it does not clearly warn that this media will be transmitted to third-party processing systems. In a media-generation context, inputs often contain faces, voices, and other biometric or sensitive content, so the missing disclosure increases privacy and data-handling risk.
The manifest describes a skill for creating AI avatar and talking-head videos with OmniHuman, Fabric, and PixVerse, but the documented workflows also invoke unrelated apps for TTS, speech transcription, and full dubbing pipelines. Those operations go beyond the stated narrow scope of avatar-video creation and describe a broader media-processing capability.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The quick start instructs users to pipe a remote install script to sh and then run infsh login, while the adjacent note frames the install step as limited to OS detection, download, and checksum verification with no broader effects. This documentation creates a misleadingly narrow description of what the overall setup sequence does, because authentication and account interaction are also part of the instructed behavior.
No suspicious patterns detected.