Dlazy Kling V3

• Outcome: Pass
• Latest audit: Jun 2, 2026 at 11:53 AM UTC
• Version:
  1.2.0

Overview

This skill is a disclosed dLazy/Kling video-generation wrapper, with expected API-key use, cloud uploads, and no evidence of hidden or destructive behavior.

Install this only if you intend to use dLazy/Kling v3 and are comfortable sending prompts and selected media files to dLazy. Prefer the npx path or review @dlazy/cli before a global install, confirm before uploading local files, and rotate or revoke the stored API key from the dLazy dashboard if needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger keyword "generate video" is overly generic and can cause the agent to invoke this third-party SaaS skill for broad user requests that were not specifically about dLazy or Kling v3. In this skill, that matters because invocation may lead to credential-dependent API calls, upload of local media files to external endpoints, and unintended routing of user content to a hosted service.

VirusTotal

63/63 vendors flagged this skill as clean.