Skills/ClawHub/character-passport

character-passport@1.0.0

VERIFIED

Publisher claims: "Cast an AI video before anything moves: for every character and hero prop, a passport (one paragraph, every visible detail, pasted word for word into every prompt), a turnaround sheet in the moodboard's look, six expressions written as cause + physical tells, a measured voice line (pace in words per minute, accent, one verbal habit), and for props the materials, wear and how they move and sound. Includes anti-slop design rules, a prompt builder that refuses paraphrased passports, code routes (three.js, VRM, SVG face rig) and tested reference sites. Use for "make a character", "consistent character", "character sheet", "turnaround", "character bible", "expression sheet", "voice for my character", "prop sheet", "same person in every shot", or characters that look generic, plastic or different from shot to shot. Not for category looks (varg-character-design), real actor photos in multi-scene ads (varg-consistent-characters) or the film's look (video-moodboard)." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher vargai · joined 7 days agoInstalls 0Last detonated 55 min ago
$clawhub install character-passport
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-04 and scored it 88/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
Python subprocess execution detectedscripts/voice_check.py:13 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Prompt injectionreferences/people.md:70 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
character-passport@1.0.0 safety verdict: Verified 88/100 — KillerSkills