UGC Manual

Generate lip-sync video from image + user's own audio recording. ✅ USE WHEN: - User provides their OWN audio file (voice recording) - Want to sync image to specific audio/voice - User recorded the script themselves - Need exact audio timing preserved ❌ DON'T USE WHEN: - User provides text script (not audio) → use veed-ugc - Need AI to generate the voice → use veed-ugc - Don't have audio file yet → use veed-ugc with script INPUT: Image + audio file (user's recording) OUTPUT: MP4 video with lip-sync to provided audio KEY DIFFERENCE: veed-ugc = script → AI voice → video ugc-manual = user audio → video (no voice generation)

Key things to check before installing or running: - Metadata mismatch: the package metadata claims no required env vars/binaries, but the script requires COMFY_DEPLOY_API_KEY and ffmpeg. Expect to supply an API key and have ffmpeg available. - Data privacy: the script uploads user-provided images and audio to https://api.comfydeploy.com and queues a fixed deployment ID. If your audio or image is sensitive or private, do not use this skill unless you trust ComfyDeploy and understand their retention/privacy policy. - Verify API key provenance: only provide COMFY_DEPLOY_API_KEY if you obtained it from a trusted ComfyDeploy account; otherwise the key could be misused to upload/queue jobs under your account. - Source provenance: the skill lists no homepage and the owner is not human-readable. If provenance is important, request the upstream source or inspect the repo before use. - Testing suggestion: run the script in a sandbox or with non-sensitive sample media first. Confirm network endpoints, deployment ID, and resulting behavior match expectations. - If you need offline or local-only processing (no upload), do not use this skill — it is designed to use ComfyDeploy and will transmit media off your machine. If you want, I can extract the exact places the code will contact the network and show the minimal set of commands/requests it will make, or help you modify the script to use a different endpoint or to run locally if available.

Type: OpenClaw Skill Name: ugc-manual Version: 1.0.2 The skill bundle is benign. The `SKILL.md` provides clear instructions for generating lip-sync videos using an image and audio, and does not contain any prompt injection attempts against the AI agent. The `scripts/generate.py` Python script implements this functionality by interacting with the `https://api.comfydeploy.com` API for file uploads, workflow queuing, and video downloads. It also uses `subprocess.run` to execute the `ffmpeg` command for audio conversion, which is explicitly mentioned in the documentation and implemented safely using a list of arguments, mitigating shell injection risks. All network and file system operations are directly related to the skill's stated purpose, and there is no evidence of malicious intent such as data exfiltration, unauthorized remote execution, or persistence mechanisms.