Dlazy Seedream 4.5

• Outcome: Pass
• Latest audit: Jun 2, 2026 at 10:29 AM UTC
• Version:
  1.2.0

Overview

This is a disclosed dLazy cloud video-generation skill that uses a third-party CLI, API key, and optional local media uploads for its stated purpose.

Before installing, review the dLazy CLI source/package because this skill runs @dlazy/cli@latest. Use it only when you intend to call dLazy, understand that prompts and referenced media files may be uploaded to dLazy, and consider using --dry-run first to check cost before spending credits.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger keyword 'generate video' is overly generic and can match many unrelated user requests, causing this skill to be invoked when the user did not specifically intend to use the dLazy Seedream tool. In this skill, unintended invocation is more concerning because it can lead to cloud API calls, local file uploads, authentication prompts, or paid usage against a third-party service.

VirusTotal

64/64 vendors flagged this skill as clean.