Skills lipsync

📦

lipsync

Name: lipsync
Author: agentspace-so

Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Create Lip-Synced Videos with RunComfy

Choosing a lip-sync model and request format can be difficult across different input types. This skill selects a suitable RunComfy route and prepares the CLI invocation.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "lipsync" from https://skillstore.io/skills/agentspace-so-lipsync.md and its manifest at https://skillstore.io/api/skills/agentspace-so-lipsync/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentspace-so-lipsync.md Signed manifest GET /api/skills/agentspace-so-lipsync/manifest Signed lockfile GET /api/skills/agentspace-so-lipsync/lockfile

Test it

Using "lipsync". Use my approved product video and French voiceover. Prioritize maximum mouth accuracy.

Expected outcome:

Selected Sync Labs sync v2 Pro for the existing-video workflow. The completed video will be saved in the requested output directory.

Using "lipsync". Make a presenter video from this approved head-and-shoulders portrait and narration.

Expected outcome:

Selected OmniHuman for a portrait-driven avatar. The portrait framing and clean narration match the recommended input pattern.

Using "lipsync". I have an approved script but no recorded audio. Generate a synchronized social clip.

Expected outcome:

Selected a script-driven Kling workflow that generates speech during video creation. Exact output depends on the current model schema.

Security Audit

High Risk

v5 • 7/23/2026 Open versioned report

All 76 static findings are false positives caused by Markdown, documentation links, example URLs, token-storage documentation, and model-selection prose. Semantic review found shell-construction, consent, and privacy risks for synthetic face-and-voice processing.

Files scanned

237

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:110-117 SKILL.md:221-223

Unsafe Inline Shell Construction for Untrusted URLs

The skill declares source URLs untrusted but demonstrates JSON inside single-quoted shell commands. A crafted value containing a quote could alter the command before the CLI receives it.

The workflow expects user-provided URLs to replace inline JSON placeholders, while Bash parses the command before runcomfy can apply its claimed input boundary.

Medium

SKILL.md:45-47 SKILL.md:218-225

Consent Enforcement Is Advisory

The skill enables pairing a person's face with separate audio and explicitly states that it does not gate inputs. Non-consensual impersonation remains possible if operator safeguards fail.

The file directly states that the skill has no input gate and assigns face and voice consent checks to the operator.

Medium

SKILL.md:212-214 SKILL.md:225-226

External Processing of Face and Voice Media

The workflow sends references to face, video, and voice assets to the RunComfy Model API. Users may disclose sensitive personal media to an external processor.

The file explicitly says the CLI posts the request to the Model API, and the documented inputs include portrait, video, and audio URLs.

Risk Factors

⚙️ External commands (38)

🌐 Network access (28)

📁 Filesystem access (2)

SKILL.md:220 SKILL.md:220

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/agentspace-so-lipsync/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentspace-so-lipsync/security.svg)](https://skillstore.io/skills/agentspace-so-lipsync?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentspace-so-lipsync?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentspace-so-lipsync/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentspace-so-lipsync.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

agentspace-so. (2026). lipsync security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/agentspace-so-lipsync/audits/5

BibTeX citation

@techreport{agentspace-so-agentspace-so-lipsync-2026,
  author = {agentspace-so},
  title = {lipsync security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/agentspace-so-lipsync/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lipsync security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "agentspace-so"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentspace-so-lipsync/audits/5"
identifiers:
  - type: other
    value: "skillstore:agentspace-so-lipsync:audit:5"
    description: "Skillstore immutable audit report identifier"

Compare variants

3 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Stronger evidence confidence

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

agentspace-so Recommended Current

agentspace-so-lipsync

Skillstore Score 38

Evidence Confidence High

Skillstore usage 8

Updated

2026-08-21

runcomfy-com

runcomfy-com-lipsync

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 6

Updated

2026-08-21

doany-ai

doany-ai-lipsync

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 6

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Dub Existing Footage

Synchronize an approved translated voiceover with an existing product, training, or brand video.

Create Talking Avatars

Turn an approved portrait and voice track into a presenter or product demonstration video.

Localize Campaign Videos

Reuse one approved identity with separate audio tracks for multiple language versions.

Try These Prompts

Sync One Video

Lip-sync this video with this audio using RunComfy. Video: [video URL]. Audio: [audio URL]. Use the recommended standard model.

Animate a Portrait

Create a talking-head video from this approved portrait and voiceover. Portrait: [image URL]. Audio: [audio URL]. Choose the best avatar route.

Optimize Model Selection

Compare Sync Labs Pro, Sync Labs v2, Kling, and Creatify for this approved video. Prioritize [quality, cost, or speed], then run the best option.

Plan Multilingual Production

Plan a multilingual lip-sync workflow for one approved portrait and [languages] audio files. Select models, identify constraints, and save outputs in [directory].

Best Practices

Confirm consent for both face and voice before processing any real person.
Use clean speech audio and align its duration with the source video.
Review the selected model schema and expected costs before starting large jobs.

Avoid

Do not create unauthorized impersonations, defamatory media, or sexual synthetic media.
Do not interpolate untrusted values directly into shell command strings.
Do not assume every model accepts the same input fields or media types.

Frequently Asked Questions

What inputs does this skill support?

It supports existing video with audio, portrait images with audio, and script-only generation through selected RunComfy models.

Do I need a recorded audio file?

No. Script-driven routes can generate speech, while precise synchronization to a specific voice requires an audio file.

Which model is recommended for existing video?

Sync Labs sync v2 Pro is the premium default. Sync v2, Kling, and Creatify offer alternatives for other priorities.

Which model is recommended for a portrait?

OmniHuman is the documented default for creating a talking avatar from one portrait and one audio track.

Does media leave my local machine?

Yes. The workflow sends media references to the RunComfy Model API and downloads generated results from RunComfy domains.

How does the skill handle consent?

It provides refusal guidance but no technical gate. The operator must verify rights for both the depicted person and the voice.

Developer Details

Author

agentspace-so

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/agentspace-so/runcomfy-agent-skills/tree/main/lipsync/

Ref

181fdefcafd96b041926e61c4b2e306ca7e7820e

Maintenance freshness

7/24/2026

Usage

5 downloads · 42 views

File structure

📄 SKILL.md