Security audit

知识付费讲师数字人 Course Avatar

Security checks for vulnerabilities and agentic risk

Overview

The skill provides a coherent cloud-based course-video workflow with scoped file uploads and disclosed credential storage.

Selected course files are processed externally by Dlazy and applicable model providers; review its [privacy policy](https://dlazy.com/en-US/legal/privacy). Share only authorized documents and media, check internal presentations for confidential content, and confirm credit costs with --dry-run before batch generation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

The required reference-image workflow lacks a warning that lecturer images are sent to an external service.

Medium

Category: Output Handling
Confidence: 93% confidence
Finding: The skill instructs the agent to pass a local portrait through gpt-image-2 --images base.png and requires this method to derive additional camera views. Although API endpoints are listed in the metadata, the skill never warns that the portrait will leave the user's system for external processing, which matters when it depicts a real lecturer.
Content: No source excerpt is available for this finding.

The workflow sends local course materials to a remote service without a privacy warning.

Medium

Category: Output Handling
Confidence: 98% confidence
Finding: The recommended file-to-video command submits an existing local presentation to a remote processing service without a sensitivity check or explicit upload disclosure. Because enterprise training and internal SOPs are expressly supported use cases, following this workflow could disclose proprietary information or personal data without informed authorization; this is a privacy-control omission rather than evidence of malicious exfiltration.
Content: No source excerpt is available for this finding.

Reference-image commands lack disclosure that local image content is sent to an external image-generation service.

Medium

Category: Output Handling
Confidence: 88% confidence
Finding: The derivation workflow instructs use of --images ./lecturer/11-third.png, supplying a local image to the image-generation service; the same operation appears at L271. The surrounding guidance explains identity consistency and credit costs but does not disclose the external transfer or its privacy implications.
Content: No source excerpt is available for this finding.

The batch workflow sends local portrait images and audio to an external generation service without a privacy warning.

Medium

Category: Output Handling
Confidence: 94% confidence
Finding: The executable workflow supplies a local lecturer image and audio files to the dlazy generation service. Although the document warns about credit consumption, it does not disclose that these potentially identifying materials leave the local system for third-party processing.
Content: No source excerpt is available for this finding.

The assembly instructions mandate Chinese subtitles without offering a language choice.

Low

Category: Output Handling
Confidence: 94% confidence
Finding: The assembly prompt explicitly requires Chinese subtitles throughout the video. Although the guide is written in Chinese, it does not obtain user opt-in for the output language or document a locale-specific requirement that justifies imposing Chinese subtitles.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.