ClawHub

Dlazy Chat

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed wrapper for the dLazy hosted chat CLI, with no artifact evidence of hidden or malicious behavior.

Install only if you intend to use dLazy's hosted service. Treat prompts, project context, and any files passed with --files as data sent to dLazy, and protect or rotate the stored API key if the machine is shared or compromised.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger keywords are overly broad and overlap with ordinary conversational phrases, which can cause the skill to activate unintentionally. In this skill's context, unintended activation is more concerning because it can prompt users or agents to invoke an external SaaS CLI, upload local files via --files, and send project-scoped conversation data to remote endpoints.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger keywords include very generic phrases such as "chat" and "talk to the agent," which overlap with normal conversational requests and can cause the skill to activate unintentionally. In an agent ecosystem, overly broad routing increases the chance that user prompts are sent to this external SaaS-backed skill unexpectedly, exposing prompts, project context, or attached files to the remote service when the user did not intend to invoke it.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal