Dlazy Pixverse C1

• Outcome: Pass
• Latest audit: Jun 2, 2026 at 10:28 AM UTC
• Version:
  1.2.0

Overview

This skill is a disclosed wrapper for the dLazy PixVerse C1 video-generation CLI, with expected cloud API use and credential storage.

Install only if you intend to use dLazy/PixVerse C1 and are comfortable installing or running the external npm CLI. Prompts and any media paths you provide will be sent to dLazy services, and an API key may be saved locally; use explicit PixVerse/dLazy requests to avoid accidental routing from generic video-generation prompts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger keyword "video generation" is overly generic and can cause this skill to activate for broad, unrelated user requests about creating videos. In an agent environment, ambiguous routing can lead to unintended execution of this third-party CLI, unnecessary API calls, file uploads, or credential prompts when the user did not specifically request PixVerse C1 or dLazy.

VirusTotal

64/64 vendors flagged this skill as clean.