ClawHub
Back to skill

Security audit

语音合成 可灵 Kling TTS

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed SaaS text-to-speech wrapper, but users should understand that it installs and runs an external dLazy CLI and stores or uses a dLazy API key.

Install only if you are comfortable running the dLazy npm CLI and sending TTS prompts to dLazy's hosted service. Prefer the on-demand npx path or review the CLI source before a global install, avoid placing real API keys in chat, and rotate the key if it is exposed. The maintainer should fix the output example to show audio instead of image output and soften the mandatory vendor-link wording.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:137
Finding

Mandatory Agent Instructions Steer Users Toward Vendor-Controlled Commercial Pages

Content
View full analysis
**AGENT CRITICAL INSTRUCTION**: > 1. If the execution result returns `code: "insufficient_balance"`, you MUST explicitly inform the user that their credits are insufficient and guide them to recharge: [https://dlazy.com/dashboard/organization/settings?tab=credits](https://dlazy.com/dashboard/organization/settings?tab=credits) > 2. If the execution result returns `code: "unauthorized"` or indicates missing API key, you MUST inform the user to get their API key from [https://dlazy.com/dashboard/organization/api-key](https://dlazy.com/dashboard/organization/api-key) and save it using `dlazy auth set ` and resume the task. ``` The Chinese-language Skill document contains equivalent mandatory instructions at `SKILL-cn.md:137-140`. ### Technical Analysis The Skill contains agent-directed instructions marked as critical and uses mandatory language such as `MUST`. These instructions do not merely document error codes; they prescribe the content of the agent's subsequent response and require the agent to direct users to vendor-controlled account and recharge pages. When loaded as agent instructions, this text can override neutral, user-directed error handling. The behavior is conditional, activating when the external CLI reports an insufficient-balance or authentication error. Because the condition depends on output from a vendor-controlled service, the service can trigger the response-steering behavior by returning one of the documented error values. This is instruction hijacking rather than arbitrary code execution. No evidence was found that these instructions alter system safety constraints, write persistent memory, or directly execute commands without an invocation of the Skill. ### Attack Path 1. A user invokes the TTS ...[truncated 1025 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unaudited Registry Package Is Installed and Executed Without Integrity Verification

Content
View full analysis
``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` ### Technical Analysis The Skill delegates all operational behavior to `@dlazy/cli@1.2.3`, retrieved from the npm registry. The version is pinned, which reduces exposure to unplanned upgrades, but the project does not include the CLI source, a dependency lockfile, an integrity digest, a signed artifact policy, or other evidence binding the reviewed source repository to the package that npm executes. The global installation option may also execute package lifecycle scripts and installs code into a location available across sessions. The `npx` alternative avoids retaining a global binary but still downloads and executes registry-supplied code. No evidence in the audited files proves that `@dlazy/cli@1.2.3` is malicious. The risk arises because the dependency implementation and its transitive dependencies are outside the supplied audit scope and are trusted to handle API credentials, submitted prompt ...[truncated 1509 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
[English](./SKILL.md) · [中文](./SKILL-cn.md)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

L019-L020 将触发词写为“文本转语音”“生成语音”，这些表述非常通用，可能出现在普通对话中，而文档没有提供限定上下文或排除示例来缩小触发范围。对 markdown 文件而言，这种宽泛触发描述容易造成技能在非预期场景下被调用。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest and surrounding documentation consistently describe this skill as Kling TTS for converting text to speech, but the example JSON output shows type: "image", a .png URL, and mimeType: "image/png". This is an active contradiction in the documentation that can mislead agents about the skill's actual result type and handling.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL-cn.md (reported line 131)May include surrounding context.

md
## 错误处理

| Code | 错误类型                         | 示例信息                                                                                                                 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401  | 未授权 (API Key缺失或无效)       | `ok: false, code: "unauthorized", message: "API key is missing or invalid"`                                                              |
| 501  | 缺少必填参数                     | `error: required option '--prompt <prompt>' not specified`                                                               |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The listed triggers include generic phrases like "text to speech" and "generate speech," which are broad natural-language requests that could match ordinary user intent outside this specific skill. The section does not provide narrowing context, explicit activation constraints, or negative examples to reduce unintended invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documented JSON output for keling-tts shows type: "image", a .png URL, and mimeType: "image/png", which directly contradicts the skill's stated TTS purpose and the command options offering audio formats mp3 and wav. This is not merely incomplete documentation; it actively describes a different media type than the skill is supposed to produce.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md
## Error Handling

| Code | Error Type                         | Example Message                                                                                                          |
| ---- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401  | Unauthorized (No API Key)          | `ok: false, code: "unauthorized", message: "API key is missing or invalid"`                                                              |
| 501  | Missing required parameter         | `error: required option '--prompt <prompt>' not specified`                                                              |

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

该文件主体说明和操作指引均以中文呈现，且未在本页说明执行时应根据用户语言偏好切换回应语言或征求用户同意。虽然 L010 提供英文文档链接，但当前自然语言指引本身没有声明语言选择策略，可能与要求基于用户偏好决定语言的组织政策冲突。

Content

No source excerpt is available for this finding.