Dlazy Wan2.6 R2v

• Outcome: Pass
• Latest audit: Jun 2, 2026 at 2:28 AM UTC
• Version:
  1.1.2

Overview

This is a disclosed cloud video-generation skill that uses a pinned dLazy CLI and API key, with no artifact-backed evidence of hidden or malicious behavior.

Before installing, be comfortable with using a third-party npm CLI and sending prompts plus selected image paths to dLazy’s cloud service. Prefer the npx form for one-off use, avoid passing private media you do not want uploaded, monitor API credit usage, and rotate or revoke the dLazy API key if needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger keywords include broad phrases like "wan 2.6" and especially "generate video," which can overlap with many ordinary user requests unrelated to this specific skill. In an agent environment, overly broad activation criteria can cause unintended invocation of this external SaaS-backed skill, leading to unnecessary data disclosure, unexpected API usage, or accidental spending of credits.

VirusTotal

63/63 vendors flagged this skill as clean.