Pose Transfer

AI-powered fashion model pose transfer tool. Generate pose variations of a model/product image using reference pose images while keeping clothing and backgro...

This skill will read your local image files and upload them to fal.ai using your FAL_KEY and then download a returned URL. Before installing or running it: (1) Review the script yourself or have someone audit it; (2) Do NOT use sensitive or private imagery you are not comfortable uploading to a third party; (3) Replace or fix the download_image function so it verifies TLS certificates (remove check_hostname=False and CERT_NONE, or use a verified requests.get with verify=True); (4) Verify that the fal-client package you install is the official client and pin a known-good version; (5) Limit and rotate the FAL_KEY you use, and check fal.ai's data retention/privacy policy; (6) Run the tool in an isolated environment (VM/container) if you have any doubt. The main concrete issue to fix in the included code is the disabled SSL verification when downloading returned image URLs.

Type: OpenClaw Skill Name: pose-transfer Version: 0.1.1 The skill provides a legitimate tool for AI pose transfer using the fal.ai API, but it contains a security vulnerability. Specifically, in `scripts/generate.py`, the `download_image` function explicitly disables SSL certificate verification (`ssl.CERT_NONE` and `check_hostname = False`), which exposes the user to Man-In-The-Middle (MITM) attacks. While the code logic is consistent with its stated purpose and no evidence of intentional malice or data exfiltration was found, this security flaw meets the criteria for a suspicious classification.