AI 生图选型指南 dLazy Image Guide

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:03 AM UTC
• Version: 1.0.0

Overview

This is a coherent dLazy image-generation guide, but users should be careful with the third-party CLI, API key storage, and remote image uploads.

Install only if you trust dLazy and the @dlazy/cli npm package. Treat the dLazy API key as a secret, prefer per-command environment use when practical, and avoid sending private, regulated, or proprietary local images unless you are comfortable with them being uploaded to files.dlazy.com.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unaudited Third-Party CLI Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Third-party dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"🎨","requires":{"bins":["npm","npx"],"env.optional":["DLAZY_API_KEY"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://dlazy.com","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, run `dlazy <model> -h` to confirm the current flags before building a command."}}

Technical Analysis

The skill instructs the host to install @dlazy/cli@1.2.3 globally or execute it through npx. The package is version-pinned and retrieved from the npm ecosystem rather than from an obviously suspicious URL, which reduces but does not eliminate supply-chain risk.

The audited project does not include the CLI source code, a package lockfile, cryptographic integrity values, package signatures, or other verifiable provenance information. Consequently, the executable dependency and its installation lifecycle scripts remain outside the audit boundary.

This dependency has access to sensitive resources needed by the documented workflow:

• The optional DLAZY_API_KEY environment variable.
• The persistent credential file at ~/.dlazy/config.json.
• Local image paths supplied by users.
• Network access to api.dlazy.com and files.dlazy.com.

The documentation discloses that local images are uploaded to files.dlazy.com, so this expected transfer is not covert data exfiltration. However, the CLI's access to credentials, files, and the network increases the impact of any malicious or compromised package release.

Attack Path

1. A user or agent activates the skill and follows its installation metadata.
2. The host runs either npm install -g @dlazy/cli@1.2.3 or npx @dlazy/cli@1.2.3.
3. npm retrieves ...[truncated 1325 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the CLI source in the security-review scope or provide a verifiable link between the npm artifact and a reviewed source revision.
2. Publish and verify npm integrity hashes, signatures, or provenance attestations before installation.
3. Prefer a project-local installation governed by a lockfile instead of a global installation.
4. Avoid unrestricted ad hoc npx execution; install the verified version once and invoke the locally pinned executable.
5. Audit the complete transitive dependency tree and all npm lifecycle scripts.
6. Run the CLI in a sandbox with access limited to the specific input files, required API endpoints, and necessary credentials.
7. Provide the API key only to the individual process that needs it rather than exposing it broadly in the environment.
8. Require explicit user confirmation before uploading local images, especially when they may contain confidential or personal information.
9. Rotate credentials and review account activity if package integrity or provenance cannot be established.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The usage guidance says the skill applies when a user wants to generate an image but has not specified a model, illustrated by the example "帮我画一张…". That phrase is common everyday language for image requests and the file does not provide tighter activation boundaries or negative examples, so it could cause unintended invocation in general image conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill instructs users to obtain an API key and notes that it is stored in ~/.dlazy/config.json or passed via DLAZY_API_KEY, but it does not warn about protecting that secret, avoiding shell history leakage, or limiting file permissions. In a skill context, normalizing direct key handling without security guidance can lead users to expose long-lived credentials through copied commands, shared machines, logs, or insecure config storage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file repeatedly frames the recommended tooling around producing accurate Chinese text, including statements like '图里要有准确的中文文字' and commands requiring Chinese titles, without indicating that language choice is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document states that when a local image path is supplied, the CLI will upload that image to files.dlazy.com before using it, but it does not clearly warn users about the privacy and data-transmission implications. In an image-processing skill, users may reasonably provide sensitive local images, so silent remote upload can lead to unintended disclosure of private or proprietary content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill title and operational guidance are entirely in Chinese, which can impose a language constraint on users without explicit opt-in. The file does not state that the skill is Chinese-only, region-specific, or provide an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The entire skill document is presented only in Chinese, with no indication that the language choice is optional or region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.