VEED UGC

Generate UGC-style promotional videos with AI lip-sync. Takes an image (person with product from Morpheus/Ad-Ready) and a script (pure dialogue), creates a video of the person speaking. Uses ElevenLabs for voice synthesis.

Before installing or running this skill, note that: (1) the included Python script will upload any image and the script text you provide to https://api.comfydeploy.com — do not upload images of real people without explicit consent; (2) the script requires a ComfyDeploy API key (COMFY_DEPLOY_API_KEY or --api-key) even though the skill metadata does not list that requirement — this mismatch is suspicious and you should provide a key with minimal privileges; (3) the script prints API responses (first 500 chars) to stdout which can leak sensitive info to logs — review or remove these debug prints if you care about secrecy; (4) ElevenLabs is referenced only for voice IDs; no ElevenLabs credential is included, because TTS is performed by the ComfyDeploy workflow — verify this behavior with the service owner; (5) the source/homepage is unknown: prefer packages with a verifiable source or inspect the code thoroughly and run in an isolated environment. If you are unsure, do not use with real users' images or private scripts until you confirm the service/policy and fix the manifest mismatch (declare the COMFY_DEPLOY_API_KEY requirement).

Type: OpenClaw Skill Name: veed-ugc Version: 1.0.1 The `scripts/generate.py` file is designed to upload local image files to `api.comfydeploy.com` for video generation. However, the script takes the `--image` argument directly as a file path without explicit validation or sanitization, making it vulnerable to arbitrary file read/upload. An attacker could potentially provide a path to a sensitive local file (e.g., `/etc/passwd`, `~/.ssh/id_rsa`), leading to its exfiltration to the `comfydeploy.com` service. While the skill's stated purpose requires file upload, this lack of input validation represents a significant vulnerability, classifying it as suspicious rather than benign.