Dlazy Happyhorse 1.0
PassAudited by ClawScan on May 6, 2026.
Overview
This is a disclosed wrapper for dLazy's hosted video API, but using it means trusting the dLazy CLI, storing a dLazy API key, and uploading any prompts or media you provide.
This skill appears coherent for cloud video generation. Before installing or invoking it, make sure you trust the @dlazy/cli npm package, understand that your dLazy API key will be stored locally, and only provide prompts or media files that you are comfortable uploading to dLazy.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing or running the CLI executes code from the @dlazy/cli npm package on the user's machine.
The skill depends on an external npm CLI package. The version is pinned and disclosed, but the CLI implementation is not included in the reviewed artifacts.
"install":"npm install -g @dlazy/cli@1.0.9","installAlternative":"npx @dlazy/cli@1.0.9"
Use the pinned version shown, prefer npx if you do not want a persistent global install, and review the linked GitHub/npm package before trusting it.
Anyone or any process that can access the saved CLI configuration may be able to use the user's dLazy organization key and credits.
The skill requires a service API key and stores it locally for future CLI use. This is expected for the dLazy API but is sensitive credential handling.
All requests require a dLazy API key... automatically saves your API key... ~/.dlazy/config.json
Protect the config file, avoid sharing the key, and rotate or revoke it from the dLazy dashboard if it may have been exposed.
Private prompts, images, videos, or audio files provided to the command will leave the local machine and be processed by dLazy.
The artifacts clearly disclose that user prompts and selected local media are sent to dLazy-hosted services.
Prompts and parameters you provide are sent to the dLazy API endpoint (`api.dlazy.com`)... local file paths you pass... are uploaded to dLazy's media storage (`files.dlazy.com`)
Only pass media and prompt content that you are comfortable uploading to dLazy, and review the service terms before using sensitive material.
An agent could unintentionally include upstream outputs or stdin data in a dLazy request.
The CLI can pull argument values from upstream pipeline data, which is useful but can accidentally send more context or data than intended if used carelessly.
Any flag also accepts pipe references — `-`... `@*`... `@stdin` / `@stdin:path`
Before invoking the command with pipe references, confirm which upstream values or files will be included.