Talking Head Production

Talking head video production with AI avatars, lipsync, and voiceover. Covers portrait requirements, audio quality, OmniHuman, PixVerse lipsync, Dia TTS. Use...

This skill appears to do what it claims (create talking‑head videos) but it directs you to run a remote installer (curl | sh) from cli.inference.sh and to upload images/audio to third‑party inference services. Before installing or running anything: (1) do not run curl | sh from an unfamiliar domain without verifying the source — prefer official release pages or GitHub releases and verify checksums yourself; (2) research the inference.sh service (privacy, data retention, who runs dist.inference.sh), and create a throwaway/test account first if you want to experiment; (3) confirm where and how infsh stores login credentials and what scopes the login grants; (4) avoid uploading sensitive personal data (faces, private audio) until you’ve confirmed data handling policies; (5) consider running the CLI in a sandbox or VM and inspect the installer script before executing. If you want, provide the cli.inference.sh and dist.inference.sh URLs or any homepage/source repository you can find and I can review those artifacts for stronger assurance.

Type: OpenClaw Skill Name: talking-head-production Version: 0.1.5 The skill bundle is classified as suspicious due to the `curl -fsSL https://cli.inference.sh | sh` command provided in `SKILL.md` for installing the `inference.sh` CLI. While this instruction is intended for the user to set up their environment and the agent's `allowed-tools` are strictly limited to `Bash(infsh *)` (preventing the agent from executing arbitrary shell commands), the `curl | sh` method itself represents a significant supply chain vulnerability. If `cli.inference.sh` were compromised, executing this command could lead to arbitrary code execution on the user's system. There is no evidence of intentional malicious behavior or prompt injection attempts against the agent.