多模态大模型 Gemini 3.1

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.3.1

Overview

This skill is a disclosed wrapper for a hosted dLazy Gemini API, with normal cloud/API and npm-package risks but no evidence of hidden or malicious behavior.

Before installing, verify that you trust the `dlazyai` publisher and the `@dlazy/cli@1.2.0` package, prefer `npx` or an isolated environment if you do not want a persistent global CLI, and only pass prompts or media files you are comfortable sending to dLazy's hosted service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Execution of a Third-Party npm Package Without Artifact Integrity Verification

Content

View full analysis

``` ```bash npm install -g @dlazy/cli@1.2.0 ``` Equivalent installation instructions are present in `SKILL-cn.md`. ### Technical Analysis Both installation methods retrieve executable package content from the npm registry and run it with the permissions of the invoking user. Pinning the dependency to version `1.2.0` reduces unintended version drift, but it does not authenticate the contents of the downloaded artifact or establish that the published npm package corresponds to the linked source repository. The Skill does not provide or validate an integrity digest for the reviewed package artifact. It also does not restrict npm lifecycle scripts. Consequently, installation can execute lifecycle hooks supplied by the package before the primary CLI command is invoked. The global installation path persists the CLI on the user's system beyond the individual Skill invocation. The `npx` path avoids a permanent global installation but still downloads and executes registry-delivered code. There is also a provenance inconsistency: the documentation states that the installation specification pins `@dlazy/cli` to version `1.0.9`, while the metadata and executable installation commands use version `1.2.0`. This discrepancy can undermine source and artifact review by leaving ambiguity about which version was actually assessed. No evidence in the audited files establishes that the current package release is malicious. The vulnerability is the unverified trust and execution model surr ...[truncated 1790 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

[English](./SKILL.md) · [中文](./SKILL-cn.md)

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL-cn.md (reported line 137)May include surrounding context.

md

## 错误处理

| Code | 错误类型                   | 示例信息                                                                                       |
| ---- | -------------------------- | ---------------------------------------------------------------------------------------------- |
| 401  | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"`                    |
| 501  | 缺少必填参数               | `error: required option '--prompt <prompt>' not specified`                                     |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

## Error Handling

| Code | Error Type                         | Example Message                                                                                                          |
| ---- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401  | Unauthorized (No API Key)          | `ok: false, code: "unauthorized", message: "API key is missing or invalid"`                                              |
| 501  | Missing required parameter         | `error: required option '--prompt <prompt>' not specified`                                                               |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

| 401  | Unauthorized (No API Key)          | `ok: false, code: "unauthorized", message: "API key is missing or invalid"`                                              |
| 501  | Missing required parameter         | `error: required option '--prompt <prompt>' not specified`                                                               |
| 502  | Local file read error              | `Error: Image file/Video file not found: C:\path\to\your\file`                                                           |
| 503  | API request failed (no balance)    | `ok: false, code: "insufficient_balance"`                                                                                |
| 503  | API request failed (server error)  | `HTTP status code error (500 server crash)`                                                                              |
| 504  | Asynchronous task execution failed | `=== Generation Failed ===` / `{Specific error reason returned by backend, for example "Prompt violates safety policy"}` |

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The provenance section states the skill's npm package is fixed to version 1.0.9, but the manifest metadata and command examples use @dlazy/cli@1.2.0. This is an active contradiction in the documentation about what code/package version the skill actually instructs the agent to install and run.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.