ClawHub
Back to skill

Security audit

文章转视频 Article to Video

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed dLazy CLI wrapper for turning articles or documents into videos, with expected external API use and file upload behavior.

Install only if you are comfortable using dLazy's hosted service. Do not attach confidential documents unless you intend to upload them to dLazy, and consider using `npx @dlazy/cli@1.2.3` instead of a global install if you prefer not to keep the CLI installed. Rotate or revoke the dLazy API key from the dashboard if it is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest markets this skill as narrowly scoped to article/text/news/essay-to-video, but the body and execution path broaden it to general document/file-to-video behavior. That scope mismatch can mislead users and higher-level agents into sending unintended file types or trusting a narrower data-handling model than the skill actually uses, increasing the chance of inappropriate file upload to the external SaaS.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill documentation presents an article-to-video capability, but the operational command explicitly binds execution to the broader `file-to-video` template. This inconsistency is dangerous because users or orchestrators may believe they are invoking a constrained article workflow while actually routing arbitrary local files through upload-enabled tooling to a third-party service, creating data exposure and least-privilege violations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.