Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Morpheus Fashion Design

v1.4.0

Generate professional advertising images with AI models holding/wearing products. ✅ USE WHEN: - Need a person/model in the image WITH a product - Creating fa...

2· 1.8k·4 current·4 all-time
byPaul de Lavallaz@pauldelavallaz

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for pauldelavallaz/morpheus-fashion-design.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Morpheus Fashion Design" (pauldelavallaz/morpheus-fashion-design) from ClawHub.
Skill page: https://clawhub.ai/pauldelavallaz/morpheus-fashion-design
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install morpheus-fashion-design

ClawHub CLI

Package manager switcher

npx clawhub@latest install morpheus-fashion-design
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The description says the skill only needs product+model images and calls a ComfyDeploy endpoint, but the shipped code requires a COMFY_DEPLOY_API_KEY (read from env or --api-key) and optionally interacts with files under ~/clawd (models catalog and a tracker script). The registry metadata declared no required env vars or config paths — that is inconsistent with what the code actually needs.
!
Instruction Scope
SKILL.md instructs 'NO logo field — EVER' and presents a canonical call with no logo, but scripts/generate.py accepts and will upload a --logo if provided (inputs['logo']). The script also contains a track_usage() function that will invoke ~/clawd/scripts/track-usage.sh if present, sending prompt and result metadata to an external tracker — this behavior is not documented in SKILL.md and could transmit sensitive prompts/images. The SKILL.md additionally references a local models catalog path and gives shell commands to read it (~/clawd/models-catalog/catalog/catalog.json), so the skill may read local files not declared in metadata.
Install Mechanism
There is no install spec in the registry (instruction-only), but the bundled script declares a Python >=3.10 requirement and an httpx dependency in its header comment. Those runtime requirements are not captured in the registry metadata; the code would need to be run in a Python environment with httpx installed. No downloads from external, untrusted URLs are present in the manifest.
!
Credentials
The script requires an API key (COMFY_DEPLOY_API_KEY or --api-key) to operate, but the registry lists no required env vars or primary credential. The optional tracker hook will run a shell script in the user's home directory (~/clawd/scripts/track-usage.sh) which could exfiltrate prompts, file paths, or result URLs — that hook is not declared in the skill metadata and therefore is disproportionate to the stated simple image-generation purpose unless the user explicitly opted into it.
Persistence & Privilege
always is false and the skill does not request persistent/autonomous privileges in metadata. However the script will read/write under the user's home path (uploads results and references ~/clawd paths) and may invoke a user-local tracker script; these are local filesystem interactions rather than platform-level privilege escalation, but they do increase the skill's local footprint and potential to run arbitrary local code via the tracker script.
What to consider before installing
Before installing or running this skill, consider the following: - The code requires a ComfyDeploy API key (COMFY_DEPLOY_API_KEY or --api-key) to function, but the registry metadata does not declare that. Verify where the key will be stored and that it has limited scope/permissions. - The SKILL.md forbids sending a `logo` field, but the script accepts and will upload a logo if provided. If you plan to upload brand assets, be aware the skill may transmit them to the ComfyDeploy endpoint — confirm that's acceptable for your IP/privacy needs. - The script contains an optional tracker hook: if ~/clawd/scripts/track-usage.sh exists it will be executed to log the prompt and result. Inspect that script before running — it could transmit prompts, filenames, or URLs off your machine. - The skill references and may read local model catalog files under ~/clawd/models-catalog/catalog/; ensure those files don't contain sensitive or private data you don't want the skill to use or upload. - The repository lacks an install spec even though the script needs Python >=3.10 and the httpx library. Run in a sandboxed environment, review/verify the code, and install dependencies manually rather than running blindly. Recommended actions: 1) Ask the publisher to update metadata to list COMFY_DEPLOY_API_KEY and the ~/clawd config paths (or make the tracker opt-in and document it). 2) Inspect or remove ~/clawd/scripts/track-usage.sh (or ensure it is trustworthy) before running the skill. 3) Run the script in an isolated environment (container/VM) and audit network traffic if you plan to use real credentials or sensitive images. 4) If you need guarantees about logos/brand assets or data retention, get those in writing from the provider or avoid uploading those assets.

Like a lobster shell, security has layers — review code before you run it.

fashionvk97582pnstgtwh2ytbj35r5nts827831imagevk97582pnstgtwh2ytbj35r5nts827831latestvk97582pnstgtwh2ytbj35r5nts827831morpheusvk97582pnstgtwh2ytbj35r5nts827831ugcvk97582pnstgtwh2ytbj35r5nts827831
1.8kdownloads
2stars
6versions
Updated 2h ago
v1.4.0
MIT-0

Morpheus Fashion Design

Generate professional fashion/product advertising images using ComfyDeploy's Morpheus Fashion Design workflow.

⚠️ CRITICAL RULES

1. NO logo field — EVER

The logo input has been removed from the API. Do NOT pass it. Only two image inputs exist:

  • product → the product being advertised
  • model → frontal face photo of the model

2. NEVER USE AUTO VALUES for packs

Configuration packs MUST NEVER be left on auto or AUTO.

auto = empty values = neutral, boring images with no creative direction.

Always select deliberately based on the brief. Custom string values are allowed and encouraged.

Pack Selection Guidelines

PackHow to Choose
style_packBrand personality: luxury→premium_restraint, sports→cinematic_realism, street→street_authentic
camera_packSports→sony_a1, editorial→hasselblad_x2d, street→leica_m6
lens_packPortrait compression? Wide? Match shot type and mood
lighting_packGolden hour? Studio? Natural window? Match brief
pose_discipline_packSport action→sport_in_motion, commercial→commercial_front_facing, UGC→street_style_candid_walk
film_texture_packWarm editorial→kodak_portra_400, cinematic→kodak_vision3_500t, clean→digital_clean_no_emulation
environment_packbeach_minimal, urban_glass_steel, street_crosswalk — or custom string
color_science_packwarm_golden_editorial, neutral_premium_clean, cinematic_low_contrast
time_weather_packgolden_hour_clear, bright_midday_sun, overcast_winter_daylight

API Details

Endpoint: https://api.comfydeploy.com/api/run/deployment/queue Deployment ID: 1e16994d-da67-4f30-9ade-250f964b2abc

Canonical API Call

const response = await fetch("https://api.comfydeploy.com/api/run/deployment/queue", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "Bearer YOUR_API_KEY"
  },
  body: JSON.stringify({
    "deployment_id": "1e16994d-da67-4f30-9ade-250f964b2abc",
    "inputs": {
      "product": "/* product image URL */",
      "model":   "/* model face URL */",
      "brief":   "Detailed scene, pose, lighting, mood, product placement...",
      "target":  "Target audience: demographics, psychographics, lifestyle...",
      "input_seed": -1,
      "branding_pack": "logo_none",
      "aspect_ratio": "9:16",
      "style_pack": "street_authentic",
      "camera_pack": "sony_a1",
      "lens_pack": "zeiss_otus_55",
      "film_texture_pack": "kodak_portra_400",
      "color_science_pack": "warm_golden_editorial",
      "shot_pack": "medium_shot",
      "pose_discipline_pack": "street_style_candid_walk",
      "lighting_pack": "natural_window",
      "time_weather_pack": "golden_hour_clear",
      "environment_pack": "urban_glass_steel",
      "intent": "awareness"
    }
  })
});

🎭 Model Catalog

GitHub: https://github.com/PauldeLavallaz/model_management Local path: ~/clawd/models-catalog/catalog/images/

Priority order

  1. User provides model image → use directly
  2. User describes model → search catalog, select best match
  3. No specification → choose based on brief context

Searching

# By body type
cat models-catalog/catalog/catalog.json | python3 -c "
import json,sys; data=json.load(sys.stdin)
for t in data['talents']:
    if t.get('body_type') in ['curvy','plus_size']:
        print(t['id'], t['name'], t['ethnicity'])
"
# By ethnicity + gender
cat models-catalog/catalog/catalog.json | jq '[.talents[] | select(.ethnicity == "hispanic" and .gender == "female") | {id, name, body_type}]'

Creative Brief — How to Write It

Write it as a real photography director's brief — specific, physical, cinematic:

Example: CasanCrem Light (ironic/viral UGC angle)

Campaña UGC TikTok para CasanCrem Light La Serenísima.
Joven de contextura robusta sostiene el pote con sonrisa cómplice en cocina hogareña argentina.
Pose relajada, apoyada en la mesada, mirando directo a cámara con energía y complicidad.
El pote visible y protagonista en la mano. Luz de ventana natural, cálida de tarde.
Estilo UGC auténtico, no publicitario clásico. Cuerpo real, relatable, no atlético.

Example: Oakley Snowboarding

Oakley snowboarding campaign. Rider on metal rail in snowpark, body slightly rotated,
arms open for balance, eyes on the line. Technical authentic freestyle pose.
Alpine snowpark, full midday daylight, compacted snow, metal structures.
Natural sun bouncing off snow — saturated colors, strong contrast.
Documentary approach — freeze rider on rail, sharp body and board.
Real session frame: balance, concentration, style merged.

Configuration Packs Reference

PackOptions
style_packpremium_restraint, editorial_precision, cinematic_realism, cinematic_memory, campaign_hero, product_truth, clean_commercial, street_authentic, archive_fashion, experimental_authorial
shot_packfull_body_wide, medium_shot, close_up, low_angle_hero, three_quarter, waist_up
camera_packarri_alexa35, canon_r5, hasselblad_x2d, leica_m6, sony_a1
lens_packcooke_anamorphic_i_50, leica_noctilux_50, zeiss_otus_55, wide_distortion_controlled
lighting_packgolden_hour_backlit, natural_window, studio_three_point, bright_midday_sun
pose_discipline_packcommercial_front_facing, street_style_candid_walk, sport_in_motion
film_texture_packkodak_portra_400, fujifilm_velvia_50, kodak_vision3_500t, digital_clean_no_emulation
color_science_packneutral_premium_clean, warm_golden_editorial, cinematic_low_contrast
environment_packbeach_minimal, urban_glass_steel, street_crosswalk — or custom descriptive string
time_weather_packgolden_hour_clear, bright_midday_sun, overcast_winter_daylight
branding_packlogo_none ← always unless logo explicitly requested
intentawareness, consideration, conversion, retention
aspect_ratio9:16, 16:9, 1:1, 4:5, 3:4

Python Upload Helper

def comfy_upload(filepath: str, api_key: str) -> str:
    from pathlib import Path
    import requests
    p = Path(filepath)
    mime = "image/png" if p.suffix == ".png" else "image/jpeg"
    with open(p, "rb") as f:
        r = requests.post(
            "https://api.comfydeploy.com/api/file/upload",
            headers={"Authorization": f"Bearer {api_key}"},
            files={"file": (p.name, f, mime)},
            timeout=60
        )
    r.raise_for_status()
    return r.json()["file_url"]

Priority Hierarchy

Talent (identity) > Product fidelity > Fit > Pose > Style > Location > Branding

Troubleshooting

Imagen negra/vacía = filtro de moderación de Google/Gemini activado.

  • No usar personas famosas o celebridades
  • Modificar el brief eliminando referencias problemáticas

API Key: NO pasar como parámetro. Ya está configurado en ComfyDeploy.

Integración con Portrait Generator

Flujo de selección de modelo (actualizado)

El campo model puede venir de dos fuentes:

Opción A — Catálogo (default):

~/clawd/models-catalog/catalog/images/model_XX.jpg

Usar cuando el guión no requiere rasgos muy específicos.

Opción B — Portrait Generator (cuando el guión lo requiere):

portrait-generator → imagen_1 (vista frontal) → model en Morpheus

Usar cuando necesitás: etnia muy específica, edad exacta, rasgos únicos, personaje que no existe en el catálogo de 114 modelos.

Regla: imagen_1 del Portrait Generator = siempre la vista frontal = la correcta para model.

Cuándo usar Portrait Generator

  • Personaje mayor de 60 años
  • Etnia muy específica no disponible en catálogo
  • Rasgos físicos únicos (cicatrices, vitiligo, asimetría facial)
  • Cualquier personaje que el guión describa con detalle

Cuándo usar el catálogo

  • Personaje genérico / sin especificaciones
  • Cualquier modelo joven-adulto estándar
  • Cuando la velocidad importa más que la precisión

Comments

Loading comments...