talking-head
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The setup_env.sh script uses shell commands to clone git repositories, manage virtual environments, and apply source code patches to downloaded modules to ensure compatibility with Apple Silicon (MPS). The animate.py script utilizes subprocess calls to ffmpeg for normalizing audio tracks and muxing the final video output.
- [EXTERNAL_DOWNLOADS]: The skill downloads source code from GitHub (jdh-algo/JoyVASA) and fetches approximately 5 GB of model weights from Hugging Face (including KlingTeam/LivePortrait and TencentGameMate/chinese-hubert-base).
- [REMOTE_CODE_EXECUTION]: The setup script downloads and executes the installer for the uv package manager from astral.sh, a well-known service for Python development tools.
- [COMMAND_EXECUTION]: The animate.py script implements a runtime shim for torch.load to allow the loading of specific model checkpoints that require full unpickling, which is documented as necessary for the JoyVASA motion generator.
Audit Metadata