Scan Report
20 /100
face-swap
Guide users to VideoAny Face Swap tool to create AI face swap videos
This is a legitimate face swap guidance skill that prints formatted instructions directing users to an external web service. The shell:exec permission is declared but not actually used by any script, representing minor over-declaration.
Safe to install
Consider removing the undeclared shell:exec permission if subprocess execution is not required. The skill would function identically with filesystem:READ only (for potential config files).
Findings 1 items
| Severity | Finding | Location |
|---|---|---|
| Low | Over-declared shell permission Doc Mismatch | SKILL.md:3 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Shell | ADMIN | NONE | ✓ Aligned | SKILL.md declares shell:exec, but guide_face_swap.py only uses argparse and prin… |
| Filesystem | NONE | NONE | — | No file operations in any script |
| Network | NONE | NONE | — | No HTTP requests made |
2 findings
Medium External URL 外部 URL
https://videoany.io/face-swap SKILL.md:14 Medium External URL 外部 URL
https://videoany.io/face-swap. clawhub.json:4 File Tree
8 files · 8.2 KB · 262 lines Python 4f · 184L
Markdown 1f · 59L
JSON 2f · 18L
Text 1f · 1L
├─
▾
scripts
│ ├─
convert_image_to_svg.py
Python
│ ├─
convert_svg.py
Python
│ ├─
guide_face_swap.py
Python
│ └─
guide_image_to_video.py
Python
├─
_meta.json
JSON
├─
clawhub.json
JSON
├─
requirements.txt
Text
└─
SKILL.md
Markdown
Security Positives
✓ No credential harvesting - no access to environment variables or sensitive paths
✓ No data exfiltration - no network requests or data transmission
✓ No obfuscation - all code is plain text Python
✓ No dependencies required - requirements.txt is empty
✓ Pure guidance tool with no side effects beyond printing text
✓ Includes responsible-use reminders for face swap ethics
✓ Backward-compatible wrappers are benign pass-through imports