ClawHub
Back to skill

Security audit

Dlazy Image Marketing Brochure

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed brochure image-generation workflow that uses a pinned dLazy CLI and cloud API, with some wording ambiguity but no evidence of hidden or malicious behavior.

Install only if you are comfortable using dLazy's cloud service, storing a dLazy API key locally, and sending brochure prompts plus any attached reference files to dLazy. Review each prompt and confirm the layout before allowing mock-up generation, especially if you do not read Chinese fluently.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill is presented as a constrained brochure-design workflow, but the terminal execution section expands behavior into a generic image-generation agent pattern. That broadening weakens scope boundaries and can cause the agent to follow command-execution instructions outside the advertised brochure-confirmation flow, increasing the chance of unintended tool use or misuse in adjacent contexts.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill defines a brochure-specific control flow with a mandatory layout-first approval gate, but the later execution section replaces that with a generic 'first image' command loop. In an agent setting, conflicting instructions can cause the model to skip required validation steps and generate assets before the user has approved the canonical layout, undermining process integrity and making downstream outputs inconsistent or misleading.

Intent-Code Divergence

High
Confidence
96% confidence
Finding
The file explicitly states that no mock-up production may occur until after explicit layout approval, but the later instructions tell the agent to prepare and generate the 'first image' immediately after prompt confirmation. This contradiction is dangerous because agents often follow the most concrete operational instructions, so the safety/quality gate can be bypassed, leading to unapproved deliverables, wasted spend on API calls, and outputs that do not match the confirmed brochure structure.

Natural-Language Policy Violations

Medium
Confidence
85% confidence
Finding
Forcing Chinese-language interaction without user opt-in can undermine user comprehension of prompts, confirmations, and command-related steps. In a tool-using skill, reduced comprehension is safety-relevant because users may approve generations or workflow transitions they do not fully understand.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.