AI Headshot Generator Skill

Overview

Turn a casual selfie into a professional headshot with a new background, business attire, and studio lighting for resumes, company websites, career profiles, and social media, from inside Claude Code, Codex, or OpenClaw. The work is produced on the hosted, paid Beatra service (mcp.beatra.ai).

This catalog entry is a reviewed pointer, not the executable package. It contains no client code and performs no Beatra operation by itself. The package it points to bundles three standard-library Python scripts that make network calls, store a credential, and can replace their own files. Read Install and Security & Safety Notes before activating it.

The archive holds regular files only (no symlinks, no executable bits, no binaries). Confirm that with the inspect commands below. Every file must be byte-identical to the source tree at the pinned commit.

When to Use This Skill

• Use when the user explicitly wants AI Headshot Generator work produced on Beatra and accepts that it is paid.
• Use when they have agreed to send prompts and any reference images to a third party.
• Do not use for local-only image editing or when no paid render was approved.

Install (pinned, verified, approved twice)

Step 1: Download and verify into a review directory

Explain that this downloads an external package from cdn.beatra.ai, then ask for approval. Only after approval:

umask 077
review_dir="$(mktemp -d)"
cd "$review_dir" || exit 1
curl --connect-timeout 10 --max-time 60 -fsSO "https://cdn.beatra.ai/agent-packages/ai-headshot-studio/v0.1.7/ai-headshot-studio-skill-0.1.7.zip"
printf '%s  %s\n' \
  'a781be7a811bc5b0e74ba5205e25d01a349c1d3d8eaf261cd653ee1d619b8ab3' \
  'ai-headshot-studio-skill-0.1.7.zip' | shasum -a 256 -c -

Stop if the check does not print OK. The expected digest comes from this catalog entry, not from a file on the same CDN.

Step 2: Inspect before activation

Before extraction, inspect every ZIP member name, Unix mode, declared size and total expanded size. Reject absolute/traversing paths, entries outside the intended package root, duplicate or case-colliding names, symlinks, devices and executable/binary files. Set bounded file-count, per-file and total extraction limits. Extract only after that preflight passes into the fresh private review directory; inspecting links after extraction cannot prevent an escape. A matching archive hash is an integrity check against this receipt, not permission to execute or proof of complete safety.

unzip -l ai-headshot-studio-skill-0.1.7.zip
# After the complete member preflight passes:
unzip -q ai-headshot-studio-skill-0.1.7.zip
find ai-headshot-studio -type l -print            # expect no output
find ai-headshot-studio -type f -perm -111 -print # expect no output
grep -n '"auto_update": True' ai-headshot-studio/scripts/mcp_client.py

Confirm byte identity with the public source tree before activation (a second, independent host):

git clone --quiet --filter=blob:none --no-checkout https://github.com/beatra-ai/ai-headshot-generator-skill.git src
git -C src checkout --quiet a8818c3568f5c3fe3c0ef65d68498c1ce2e81b3a -- skills/ai-headshot-studio
(cd ai-headshot-studio && find . -type f | LC_ALL=C sort | xargs shasum -a 256) > archive.sha
(cd src/skills/ai-headshot-studio && find . -type f | LC_ALL=C sort | xargs shasum -a 256) > tree.sha
cmp archive.sha tree.sha && echo IDENTICAL

Report to the user what the review found: SKILL.md, manifest.json, the bundled Markdown references, and scripts/authorize.py, scripts/mcp_client.py, scripts/uninstall.py (Python 3.10+, standard library only, no dependency installation, no lifecycle hooks). Summarize the network, credential, local-state, telemetry, and self-update behavior listed

…