Morpheus Fashion Design

Generate professional advertising images with AI models holding/wearing products. ✅ USE WHEN: - Need a person/model in the image WITH a product - Creating fa...

Before installing or running this skill, consider the following: - The code requires a ComfyDeploy API key (COMFY_DEPLOY_API_KEY or --api-key) to function, but the registry metadata does not declare that. Verify where the key will be stored and that it has limited scope/permissions. - The SKILL.md forbids sending a `logo` field, but the script accepts and will upload a logo if provided. If you plan to upload brand assets, be aware the skill may transmit them to the ComfyDeploy endpoint — confirm that's acceptable for your IP/privacy needs. - The script contains an optional tracker hook: if ~/clawd/scripts/track-usage.sh exists it will be executed to log the prompt and result. Inspect that script before running — it could transmit prompts, filenames, or URLs off your machine. - The skill references and may read local model catalog files under ~/clawd/models-catalog/catalog/; ensure those files don't contain sensitive or private data you don't want the skill to use or upload. - The repository lacks an install spec even though the script needs Python >=3.10 and the httpx library. Run in a sandboxed environment, review/verify the code, and install dependencies manually rather than running blindly. Recommended actions: 1) Ask the publisher to update metadata to list COMFY_DEPLOY_API_KEY and the ~/clawd config paths (or make the tracker opt-in and document it). 2) Inspect or remove ~/clawd/scripts/track-usage.sh (or ensure it is trustworthy) before running the skill. 3) Run the script in an isolated environment (container/VM) and audit network traffic if you plan to use real credentials or sensitive images. 4) If you need guarantees about logos/brand assets or data retention, get those in writing from the provider or avoid uploading those assets.

Type: OpenClaw Skill Name: morpheus-fashion-design Version: 1.4.0 The skill is classified as suspicious due to the presence of shell execution capabilities that could be exploited as vulnerabilities. The `SKILL.md` explicitly instructs the agent to execute `bash` commands involving `cat`, `python3 -c`, and `jq` for model catalog search, demonstrating the agent's ability to run arbitrary shell commands. Furthermore, the `scripts/generate.py` file uses `subprocess.run` to execute an external script `~/clawd/scripts/track-usage.sh`, which, depending on the content of `track-usage.sh` and the sanitization of its arguments, could pose a shell injection risk. While there is no clear evidence of intentional malicious behavior like data exfiltration to unauthorized parties or backdoors, these shell execution capabilities represent significant security vulnerabilities.