ClawHub
Back to skill

Security audit

Dlazy Generate

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed dLazy media-generation wrapper, but its broad activation terms and persistent API-key storage deserve user review before installation.

Install only if you expect agents to use dLazy for cloud media generation. Prefer the npx or DLAZY_API_KEY per-run option on shared systems, review local files before passing their paths, and revoke or remove the stored key with dlazy logout when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger keywords are very broad generic terms like '生成' and '创建图片、视频、音频', which are likely to match ordinary user requests outside the intended scope. This can cause the skill to auto-activate unexpectedly and route users into installing or using a third-party CLI and external SaaS, increasing the chance of unintended command execution, data transmission, or credential setup prompts.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger keywords are extremely broad, especially 'generate' and 'create image, video, audio', which can cause this skill to activate for many ordinary user requests not specifically intended for this tool. In an agentic environment, overbroad routing increases the chance of unintended execution of an external CLI that uploads prompts and local files to third-party services, creating privacy and action-confusion risk.

Session Persistence

Medium
Category
Rogue Agent
Content
## Trigger Keywords

- generate
- create image, video, audio
- multimodal generation

## Authentication
Confidence
85% confidence
Finding
create image, video, audio - multimodal generation ## Authentication All requests require a dLazy API key. The recommended way to authenticate is `dlazy login`: ```bash dlazy login ``` This runs a

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.