Talking Head Production
Analysis
This is a coherent instruction-only skill for AI talking-head video creation, but it relies on an external CLI, account login, and sending portrait/audio/video assets to external AI services.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
curl -fsSL https://cli.inference.sh | sh && infsh login
The skill directs users to install an external CLI through a remote shell script rather than a registry install spec. This is disclosed and central to the workflow, but the installer provenance is outside the provided artifact set.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
infsh login
The workflow requires logging into the inference.sh CLI, which gives the tool access to a user account for running AI jobs. This is expected for the service integration and no credential leakage is shown.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
infsh app run bytedance/omnihuman-1-5 --input '{
"image": "portrait.png",
"audio": "narration.mp3"
}'The documented workflow sends local portrait and audio/video inputs to external inference.sh apps. This is purpose-aligned, but it involves potentially sensitive face, voice, or likeness data.