Dlazy Video Generate

• Outcome: Pass
• Latest audit: Jun 2, 2026 at 10:29 AM UTC
• Version:
  1.2.0

Overview

This skill is a disclosed dLazy video-generation wrapper that uses a pinned CLI, cloud API calls, and user-provided media uploads for its stated purpose.

Install only if you are comfortable using dLazy's cloud service: prompts and any media paths you provide can be uploaded, generation may consume paid credits, and an API key may be saved locally. Use the npx option if you do not want a persistent global CLI install, and rotate or revoke the API key if it is no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger keywords are broad everyday phrases, which can cause the agent to invoke this skill unintentionally during normal conversation. Because the skill is designed to run CLI commands that may upload local files and send prompts to external APIs, accidental activation could lead to unexpected network actions, privacy exposure, or unintended charges.

VirusTotal

64/64 vendors flagged this skill as clean.