ClawHub
Back to skill

Security audit

声音克隆 可灵 Kling Audio Clone

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it should be reviewed because it uploads voice samples to a third-party service and its documentation is inconsistent about what it runs and returns.

Install only if you trust dLazy and the @dlazy/cli package, are comfortable uploading the selected voice reference to dLazy-hosted services, and have authorization from the speaker whose voice is being cloned. Prefer npx or another temporary execution method over a global install, review the CLI source/package provenance, and use a revocable API key.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unverified Third-Party CLI Installation and Execution

Content
View full analysis
``` ```bash npm install -g @dlazy/cli@1.2.3 ``` ### Technical Analysis The Skill directs the environment to retrieve and execute the external npm package `@dlazy/cli@1.2.3`. Pinning the package version reduces exposure to unexpected upgrades, but the audited project does not contain the CLI source, a package lock file, a cryptographic integrity value, a vendored package, or another mechanism that proves the downloaded artifact corresponds to reviewed source code. Both `npm install -g` and `npx` can execute package lifecycle or runtime code under the privileges of the invoking user. The global installation option additionally leaves the CLI installed after the Skill invocation. The CLI is expected to receive a dLazy API key, read user-selected reference audio, and communicate with external services. Consequently, compromise of the npm account, package artifact, registry delivery path, or referenced release could expose sensitive credentials and biometric audio. This finding identifies a supply-chain trust weakness. The available project files do not establish that the currently published package is malicious. ### Attack Path 1. An attacker compromise ...[truncated 1649 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This skill enables voice cloning from uploaded reference audio but does not prominently warn about consent, impersonation, and biometric privacy risks. In this context, omission is dangerous because users may upload another person’s voice without authorization, leading to privacy harm, impersonation, fraud, or policy violations.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
[English](./SKILL.md) · [中文](./SKILL-cn.md)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

L019 的“克隆声音”和 L020 的“定制语音”都较为泛化，缺少上下文限定，可能与普通对话请求或其他语音相关技能产生重叠。文档也未提供负面示例或明确说明何种表述不应触发该技能，因此触发边界不够清晰。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is described throughout as a Kling audio cloning tool, but the documented JSON output shows type: "image", an image URL ending in .png, and mimeType: "image/png". This directly contradicts the stated intent and command purpose, creating a clear documentation-to-behavior divergence for consumers of the skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The command help for this skill lists --audio_url and --name as options, but the examples invoke --prompt, and the error table refers to missing --prompt plus Image file/Video file not found. These documentation elements actively describe a different modality and interface than the audio-clone command shown above, indicating intent-code/documentation divergence.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL-cn.md (reported line 129)May include surrounding context.

md
## 错误处理

| Code | 错误类型                         | 示例信息                                                                                                                 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401  | 未授权 (API Key缺失或无效)       | `ok: false, code: "unauthorized", message: "API key is missing or invalid"`                                                              |
| 501  | 缺少必填参数                     | `error: required option '--prompt <prompt>' not specified`                                                               |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes generic phrases such as "clone voice" and "custom speech," which are broad natural-language requests that could match everyday conversation rather than a narrowly scoped skill invocation. The section also provides no exclusion conditions or negative examples to clarify when this skill should not activate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill is documented as a Kling Audio Clone tool for generating customized speech from reference audio, but the documented output schema returns type: "image", result.png, and the error text refers to image/video file handling and a required --prompt parameter. These comments and examples actively describe a different kind of media-generation command than the audio-clone behavior claimed elsewhere in the file.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
## Error Handling

| Code | Error Type                         | Example Message                                                                                                          |
| ---- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401  | Unauthorized (No API Key)          | `ok: false, code: "unauthorized", message: "API key is missing or invalid"`                                                              |
| 501  | Missing required parameter         | `error: required option '--prompt <prompt>' not specified`                                                              |

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

L078-L080 的关键执行指令仅以中文表述，整份文件也默认以中文规定代理行为，未说明是否可根据用户语言偏好切换。按照语言/locale 政策，若技能对输出或操作语言施加强制约束而无用户选择，可能构成自然语言层面的策略问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.