Talking Head Production

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only skill for AI talking-head video creation, but it relies on an external CLI, account login, and sending portrait/audio/video assets to external AI services.

Before installing, verify the inference.sh CLI installer and only upload portraits, voices, scripts, or videos that you are allowed to process with external AI services.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Running the setup command installs software from an external source before using the skill.

Why it was flagged

The skill directs users to install an external CLI through a remote shell script rather than a registry install spec. This is disclosed and central to the workflow, but the installer provenance is outside the provided artifact set.

Skill content

curl -fsSL https://cli.inference.sh | sh && infsh login

Recommendation

Verify the CLI source, checksum, and installer instructions from inference.sh before running the setup command.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill may run jobs under the user's inference.sh account and may incur account usage or charges depending on the service.

Why it was flagged

The workflow requires logging into the inference.sh CLI, which gives the tool access to a user account for running AI jobs. This is expected for the service integration and no credential leakage is shown.

Skill content

infsh login

Recommendation

Use the intended account, understand any billing or quota impact, and avoid sharing credentials in prompts or files.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Personal images, voice recordings, scripts, or generated videos may be processed by external AI providers.

Why it was flagged

The documented workflow sends local portrait and audio/video inputs to external inference.sh apps. This is purpose-aligned, but it involves potentially sensitive face, voice, or likeness data.

Skill content

infsh app run bytedance/omnihuman-1-5 --input '{
  "image": "portrait.png",
  "audio": "narration.mp3"
}'

Recommendation

Only use media you have rights and consent to process, and review the provider's privacy, retention, and usage terms.