← 返回 Skills 市场

九马免费对口型数字人

Name: 九马免费对口型数字人
Author: kalos-chen

作者 kalos-chen · GitHub ↗ · v1.0.6 · MIT-0

cross-platform ⚠ suspicious

总下载

当前安装

版本数

在 OpenClaw 中安装

/install jiuma-mata-human

功能描述

这是一个免费生成对口型数字人对口型的工具, 工具安装需要下载二进制文件到电脑上，只需根据文本和性别生成数字人视频并返回一个下载链接,生成时间在半个小时以内。

使用说明 (SKILL.md)

\r \r \r

使用场景\r

当用户询问"生成数字人"时, 请按照一下步骤操作:\r 第一步, 提示用户输入文本内容, 文字字数大于10个字, 小于100字, 等待用户输入确认 text=文本内容\r 第二步, 提示用户输入数字人性别(男或女), 等待用户输入确认 sex=性别\r \r \r

下载文件 (openclaw的workspace为./目录)\r

检查 ./skills/9ma-mata-human 文件夹是否存在, 不能存在就创建 \r 检查 ./skills/9ma-mata-human 文件夹是否存在 skill-win.exe 或 skill-linux\r 不存在话执行以下操作\r 如果本机系统为windows环境, 从 https://down-monitor.yisu.com/9ma/skills/9ma-mata-human/skill-win.exe 下载到 ./skills/9ma-mata-human 目录下\r 如果本机系统为linux环境, 从 https://down-monitor.yisu.com/9ma/skills/9ma-mata-human/skill-linux 下载到 ./skills/9ma-mata-human 目录下,然后执行 chmod +x ./skills/9ma-mata-human/skill-linux\r \r \r

执行方式\r

当前获取到的参数是 {{.text}} {{.sex}}\r 如果本机系统为windows环境, 运行 ./skills/9ma-mata-human/skill-win.exe "{{.text}}" "{{.sex}}", 等待下载链接地址返回\r 如果本机系统为linux环境, 运行 ./skills/9ma-mata-human/skill-linux "{{.text}}" "{{.sex}}", 等待下载链接地址返回

安全使用建议

This skill downloads and runs an unsigned binary from an unknown domain and then executes it with user-supplied text — that lets the binary do anything on your machine (including network exfiltration). Only install if you fully trust the publisher and have verified the binary (cryptographic checksum/signature) and source. Safer options: ask the author for source code or a reproducible build, require a signed release from a known host (GitHub releases, official vendor), run the skill inside a tightly isolated sandbox or disposable VM, or prefer skills that call a documented API rather than downloading and executing opaque binaries. Also note the SKILL.md has a parameter naming bug (two 'text' parameters); ask for a corrected manifest. If you must try it, test in an isolated environment and monitor outbound network traffic.

功能分析

Type: OpenClaw Skill Name: jiuma-mata-human Version: 1.0.6 The skill '9ma-mata-human' is classified as suspicious because its instructions in `skill.md` direct the agent to download and execute unverified binary files (`skill-win.exe` and `skill-linux`) from a remote server (`down-monitor.yisu.com`). While this behavior is aligned with the tool's stated purpose of generating digital human videos, the execution of opaque binaries from external sources is a high-risk pattern that allows for arbitrary code execution (RCE) and bypasses source code review. There is no explicit evidence of malicious intent in the markdown, but the delivery mechanism is inherently dangerous.

能力评估

ℹ Purpose & Capability

The stated purpose (generate lip‑synced digital-human videos from text and gender) plausibly could require a native binary encoder/renderer. Requiring a binary is not inherently incoherent, but the skill provides no source code, no provenance, and no integrity checks for the binary — so the need to download and run an opaque executable is only weakly justified by the description.

⚠ Instruction Scope

The runtime instructions tell the agent to create a ./skills/9ma-mata-human folder, download a platform-specific binary from https://down-monitor.yisu.com/..., mark it executable, and run it with the user's text and sex. That gives the downloaded program full ability to run arbitrary code and make network calls. The SKILL.md also contains a parameter naming bug (two entries named 'text' instead of 'text' and 'sex'), which increases the chance of incorrect runtime behavior. Instructions do not limit or validate the binary's network activity or include any integrity checks (checksum/signature).

⚠ Install Mechanism

High-risk install: instruction-only skill directs a runtime download of a prebuilt binary from a non-obvious third-party domain (down-monitor.yisu.com). There is no cryptographic checksum, no signature, no GitHub releases or known upstream, and the binary will be executed. According to the install-risk guidance, this pattern is high risk because arbitrary code from an untrusted host will be written to disk and executed.

✓ Credentials

The skill does not request environment variables, credentials, or config paths. From the declared requirements, there is no immediate overreach in requested secrets. However, because the downloaded binary runs locally, it could access environment variables or files at runtime — this is not declared in SKILL.md and therefore is a practical risk.

ℹ Persistence & Privilege

The skill does not request always:true and is user-invocable only. It writes into ./skills/9ma-mata-human within the agent workspace (creates folder and places the binary there) — this is limited persistence but still allows long-lived executable code to remain on disk. The permission/persistence requested is modest but combined with the unknown binary increases risk.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install jiuma-mata-human
安装完成后，直接呼叫该 Skill 的名称或使用 /jiuma-mata-human 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.6

9ma-mata-human 1.0.6 - Improved SKILL.md documentation with detailed instructions for use and setup. - Clarified supported arguments and parameters (text and sex) for generating digital human lip-sync videos. - Added step-by-step user prompts for text input and sex selection. - Included clear instructions for downloading and running platform-specific binaries (Windows/Linux). - Provided usage scenarios and download link retrieval process.

元数据

Slug jiuma-mata-human

版本 1.0.6

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题