Security audit
Security checks for vulnerabilities and agentic risk
ClawScan classifies this skill as benign because the reported findings are considered expected for its purpose, while noting installation supply-chain and image-sharing risks; the scan was partial.
The verdict is benign, but not risk-free. Before installing, consider whether you are comfortable using the unpinned installer and check its version and source. If you use reference images, confirm which service will receive them and review its data handling terms before uploading. The scan was partial because one local path-like reference could not be resolved, so the available evidence does not cover that reference.
The installation example runs an unpinned npm package through npx and retrieves skill content without an immutable revision. Although this is an installer rather than an MCP server declaration, it presents a supply-chain risk: a compromised or unexpectedly changed release could execute code or install malicious agent instructions with the user's permissions.
The workflow recommends using face-reference stills with externally hosted generation services without explicitly disclosing that those images may leave the user's environment. The skill's likeness-permission rules reduce misuse risk, but permission to depict someone does not necessarily authorize sharing their identifiable images with third-party processors.
