ClawHub
Back to skill

Security audit

Dlazy Audio Generate

Security checks across malware telemetry and agentic risk

Overview

This audio-generation skill uses a disclosed cloud CLI and API key flow; its main risk is that users should avoid sending prompts or media they do not want uploaded to dLazy.

Install only if you are comfortable using dLazy's hosted service. Prompts, parameters, and any media files you pass for audio or voice cloning may be uploaded, and login can save an API key locally; use npx or DLAZY_API_KEY per invocation if you want less persistent setup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill is advertised as handling audio generation, but its documentation includes cross-media piping examples using image, video, and super-resolution commands. This scope mismatch can cause an agent to invoke unrelated capabilities or pass files/URLs into broader dlazy workflows than the user intended, increasing the chance of unintended data transfer or overbroad tool use.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger keywords are broad and unspecific, such as 'generate audio' and 'text to speech, TTS', without constraints on context or boundaries. In agent ecosystems, broad triggers can cause unintended invocation of this skill for loosely related prompts, leading to accidental use of an external networked CLI, possible credential prompts, or unintended transmission of user content to third-party APIs.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.