语音合成 可灵 Kling TTS

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:57 AM UTC
• Version: 1.3.8

Overview

This skill is a disclosed SaaS text-to-speech wrapper, but users should understand that it installs and runs an external dLazy CLI and stores or uses a dLazy API key.

Install only if you are comfortable running the dLazy npm CLI and sending TTS prompts to dLazy's hosted service. Prefer the on-demand npx path or review the CLI source before a global install, avoid placing real API keys in chat, and rotate the key if it is exposed. The maintainer should fix the output example to show audio instead of image output and soften the mandatory vendor-link wording.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:137
• Finding: Mandatory Agent Instructions Steer Users Toward Vendor-Controlled Commercial Pages< > 2. If the execution result returns `code: "unauthorized"` or indicates missing API key, you MUST inform the user to get their API key from [https://dlazy.com/dashboard/organization/api-key](https://dlazy.com/dashboard/organization/api-key) and save it using `dlazy auth set <key>` and resume the task. ``` The Chinese-language Skill document contains equivalent mandatory instructions at `SKILL-cn.md:137-140`. ### Technical Analysis The Skill contains agent-directed instructions marked as critical and uses mandatory language such as `MUST`. These instructions do not merely document error codes; they prescribe the content of the agent's subsequent response and require the agent to direct users to vendor-controlled account and recharge pages. When loaded as agent instructions, this text can override neutral, user-directed error handling. The behavior is conditional, activating when the external CLI reports an insufficient-balance or authentication error. Because the condition depends on output from a vendor-controlled service, the service can trigger the response-steering behavior by returning one of the documented error values. This is instruction hijacking rather than arbitrary code execution. No evidence was found that these instructions alter system safety constraints, write persistent memory, or directly execute commands without an invocation of the Skill. ### Attack Path 1. A user invokes the TTS ...[truncated 1025 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove agent-facing directives such as `CRITICAL INSTRUCTION`, `MUST`, and the requirement to resume the task after credentials are configured. 2. Represent error behavior as neutral documentation or structured metadata rather than instructions that dictate the agent's response. 3. Allow the agent to report the original error without automatically including commercial calls to action. 4. If support links are necessary, label them as optional vendor documentation and present them only when the user asks how to resolve the error. 5. Do not require the agent to solicit, display, or handle an API key. Instruct users never to place credentials in chat or command history. 6. Apply the same changes to both `SKILL.md` and `SKILL-cn.md` so the language variants enforce identical, neutral behavior. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unaudited Registry Package Is Installed and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5, 48-54` **Equivalent Location**: `SKILL-cn.md:5, 48-54` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazyai/cli","source":"https://github.com/dlazyai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy keling-tts -h for help."}} ``` ```markdown You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). Review the GitHub source before installing. ``` ### Technical Analysis The Skill delegates all operational behavior to `@dlazy/cli@1.2.3`, retrieved from the npm registry. The version is pinned, which reduces exposure to unplanned upgrades, but the project does not include the CLI source, a dependency lockfile, an integrity digest, a signed artifact policy, or other evidence binding the reviewed source repository to the package that npm executes. The global installation option may also execute package lifecycle scripts and installs code into a location available across sessions. The `npx` alternative avoids retaining a global binary but still downloads and executes registry-supplied code. No evidence in the audited files proves that `@dlazy/cli@1.2.3` is malicious. The risk arises because the dependency implementation and its transitive dependencies are outside the supplied audit scope and are trusted to handle API credentials, submitted prompt ...[truncated 1509 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Vendor the reviewed CLI implementation and its locked dependency graph into the audited release, or provide reproducible build evidence connecting the published npm artifact to the reviewed source. 2. Publish and verify an immutable integrity digest or cryptographic signature for the expected package artifact before execution. 3. Include a lockfile with integrity entries for all transitive dependencies where the deployment model permits it. 4. Prefer a restricted, non-global installation over `npm install -g` to reduce persistence and system-wide exposure. 5. Disable npm lifecycle scripts where compatible with the package, for example by using an installation policy equivalent to `--ignore-scripts`. 6. Run the CLI under least privilege with narrowly scoped filesystem and network permissions. 7. Restrict outbound connections to the documented endpoints only after independently validating that those endpoints are required. 8. Store API credentials in an operating-system credential manager where possible, rather than a regular configuration file. 9. Document the exact reviewed package digest and establish a process for re-auditing every package or dependency update. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Ae1

High

• Category: analysis-evasion

Content

[English](./SKILL.md) · [中文](./SKILL-cn.md)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: L019-L020 将触发词写为“文本转语音”“生成语音”，这些表述非常通用，可能出现在普通对话中，而文档没有提供限定上下文或排除示例来缩小触发范围。对 markdown 文件而言，这种宽泛触发描述容易造成技能在非预期场景下被调用。

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The manifest and surrounding documentation consistently describe this skill as Kling TTS for converting text to speech, but the example JSON output shows `type: "image"`, a `.png` URL, and `mimeType: "image/png"`. This is an active contradiction in the documentation that can mislead agents about the skill's actual result type and handling.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## 错误处理

| Code | 错误类型                         | 示例信息                                                                                                                 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401  | 未授权 (API Key缺失或无效)       | `ok: false, code: "unauthorized", message: "API key is missing or invalid"`                                                              |
| 501  | 缺少必填参数                     | `error: required option '--prompt <prompt>' not specified`                                                               |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The listed triggers include generic phrases like "text to speech" and "generate speech," which are broad natural-language requests that could match ordinary user intent outside this specific skill. The section does not provide narrowing context, explicit activation constraints, or negative examples to reduce unintended invocation.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The documented JSON output for `keling-tts` shows `type: "image"`, a `.png` URL, and `mimeType: "image/png"`, which directly contradicts the skill's stated TTS purpose and the command options offering audio formats `mp3` and `wav`. This is not merely incomplete documentation; it actively describes a different media type than the skill is supposed to produce.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## Error Handling

| Code | Error Type                         | Example Message                                                                                                          |
| ---- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401  | Unauthorized (No API Key)          | `ok: false, code: "unauthorized", message: "API key is missing or invalid"`                                                              |
| 501  | Missing required parameter         | `error: required option '--prompt <prompt>' not specified`                                                              |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: 该文件主体说明和操作指引均以中文呈现，且未在本页说明执行时应根据用户语言偏好切换回应语言或征求用户同意。虽然 L010 提供英文文档链接，但当前自然语言指引本身没有声明语言选择策略，可能与要求基于用户偏好决定语言的组织政策冲突。

Static analysis

No suspicious patterns detected.