Security audit
音乐生成 ElevenLabs Music
Security checks across malware telemetry and agentic risk
Overview
The skill is coherent for cloud music generation, but it asks users to persist a dLazy organization API key locally while the claimed file-permission protection is not clearly enforced by the pinned CLI.
Review this before installing if the dLazy API key has paid credits or broad organization access. Prefer passing DLAZY_API_KEY per invocation or verify that ~/.dlazy/config.json is readable only by your account after login. Also expect prompts and any file paths you explicitly provide to be sent to dLazy's hosted service.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.