Deepfake Check

Detect deepfakes in images or videos using the Scam.ai API. Guides the user through API key setup if needed, then analyzes uploaded files for face-swap/deepf...

Security Scan

The skill's instructions, requested access, and network calls are coherent with its stated purpose of using Scam.ai to detect deepfakes — there are no unrelated credentials or hidden installs — but it will upload user files and store API keys in local files, which has privacy implications the user should consider.

Purpose & Capability

The name/description match the runtime instructions: the skill looks for a Scam.ai API key, then uploads an image or video to Scam.ai endpoints for analysis. It does not request unrelated credentials, binaries, or system config paths.

Instruction Scope

The SKILL.md instructs the agent to read/write key files in the user's home (~/.scamai_deepfake_key or ~/.scamai_universal_key), confirm local file existence, and POST the file to api.scam.ai with curl. These actions are expected for this service, but they mean the agent will access your home directory and transmit the provided media to a third-party API (Scam.ai). The skill also saves user-provided API keys to disk (mode 600).

Install Mechanism

No install spec or external downloads — this is instruction-only, which minimizes installation risk.

Credentials

No environment variables or external credentials are declared; the skill uses user-supplied Scam.ai API keys stored in files. That is proportionate to the stated purpose. Note: keys are stored as plaintext files protected only by filesystem permissions (chmod 600).

Persistence & Privilege

always is false and the skill does not request system-wide persistence or modify other skills. Its only persistent effect is saving the API key files in the user's home directory.

Assessment

This skill appears to do what it says, but consider the following before installing: - Privacy: the skill uploads your image/video files to Scam.ai (https://api.scam.ai). Do not upload sensitive or private media unless you trust the service and have the user's consent. - API key storage: it saves whatever API key you provide to ~/.scamai_deepfake_key or ~/.scamai_universal_key with chmod 600. That protects the file from other users but is not encrypted — delete the file if you no longer want the key stored. - If you prefer tighter control, do not allow the agent to run the Bash commands; instead manually obtain a key and run the curl commands yourself and paste results back. - Verify you trust the domain (scam.ai) and review its privacy policy and rate limits before uploading sensitive data. - If you have low trust in the skill, avoid providing keys or media and run the detection directly using Scam.ai's docs.

Deepfake Detection

You help users detect deepfake content (face swaps, AI-generated faces) in images and videos using the Scam.ai API.

Step 1 — API Key Setup

Use the Bash tool to find an available API key, checking in this order:

cat ~/.scamai_deepfake_key 2>/dev/null

cat ~/.scamai_universal_key 2>/dev/null

• If ~/.scamai_deepfake_key has content → use it.
• Else if ~/.scamai_universal_key has content → use it.
• If neither exists, ask the user:

Do you already have a Scam.ai API key?

• Yes, I have a DeepFake Detection key — paste it here.
• Yes, I have a Universal key — paste it here (works for all services).
• No — follow these steps to get one:
  1. Go to https://scam.ai and click Sign Up (or Log In)
  2. In the left sidebar, scroll to the bottom → Manage account → Developers
  3. Click + Create API Key in the top right
  4. Under Service Type, choose:
     • DeepFake Detection — for this skill only
     • Universal Key — one key for all Scam.ai services (recommended if you plan to use multiple skills)
  5. Give it a name, create it, copy the key, and paste it here

Once the user provides the key, save it to the matching file:

• DeepFake Detection key → ~/.scamai_deepfake_key
• Universal key → ~/.scamai_universal_key

echo -n "THEIR_API_KEY" > ~/.scamai_deepfake_key && chmod 600 ~/.scamai_deepfake_key
# or for universal:
echo -n "THEIR_API_KEY" > ~/.scamai_universal_key && chmod 600 ~/.scamai_universal_key

Confirm: "API key saved! You won't need to enter it again."

---

Step 2 — Get the File to Analyze

If the user didn't pass $ARGUMENTS, ask:

Please provide the path to the image (.jpg, .jpeg, .png, .webp) or video (.mp4, .mov, .avi, .mkv) you want to analyze.

Expand ~ in paths if needed. Confirm the file exists before proceeding.

---

Step 3 — Run Detection

Use whichever key was found in Step 1 (deepfake-specific or universal). Resolve it first:

API_KEY=$(cat ~/.scamai_deepfake_key 2>/dev/null || cat ~/.scamai_universal_key 2>/dev/null)

For images (.jpg, .jpeg, .png, .webp, .gif, .bmp):

curl -s -X POST "https://api.scam.ai/api/defence/faceswap/predict" \
  -H "x-api-key: $API_KEY" \
  -F "files=@PATH_TO_FILE"

For videos (.mp4, .mov, .avi, .mkv, .webm):

curl -s -X POST "https://api.scam.ai/api/defence/video/detection" \
  -H "x-api-key: $API_KEY" \
  -F "video=@PATH_TO_FILE"

Show a brief "Analyzing file, please wait…" message before running the command since video analysis can take time.

---

Step 4 — Interpret and Present Results

Parse the JSON response and present a single line:

Verdict: [Real / Deepfake / Suspicious] — [X]% confidence

Example: Verdict: Deepfake — 94.2% confidence

Do not show any other fields. If the user wants more details, they can ask.

If the API returns an error:

• 401 Unauthorized → "Your API key appears to be invalid or expired. Run /deepfake-detection again to update it."
• 429 Too Many Requests → "You've hit the Scam.ai rate limit. Please wait a moment and try again."
• Any other error → show the raw error message and suggest checking https://scam.ai/docs

---

Step 5 — Wrap Up

After presenting the results, ask:

Would you like to analyze another file, or are you done?

• Another file → go back to Step 2.
• Done → reply with:

Thanks for using the Deepfake Detection skill! Stay safe online. Follow Scam.ai for the latest in AI-powered fraud and deepfake protection: https://scam.ai

---

Notes

• The stored key is at ~/.scamai_deepfake_key (mode 600, readable only by you).
• To update your key, just run /deepfake-detection again and say "No" when asked if you have a key, or manually delete ~/.scamai_deepfake_key.
• This key is separate from the Gen AI Detection key (~/.scamai_genai_key) — each service requires its own key type.
• Scam.ai free-tier limits may apply; check your dashboard at https://scam.ai for usage.