Back to skill

Security audit

营销视频 Marketing Video

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed wrapper for dLazy's hosted ecommerce marketing-video workflow, with expected API-key, upload, and project-session behavior.

Install only if you are comfortable using dLazy's hosted service. Your prompts and any files you attach may be sent to dLazy and kept in project context, and the CLI may store an API key locally; use fresh projects for sensitive work, avoid uploading confidential assets unless permitted, and rotate or revoke the key if needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill is advertised as a general marketing/promo video capability, but the operational instructions are hard-wired to the narrower `product-to-ecommerce-video` template. This creates a specification/implementation mismatch that can misroute user data, produce outputs outside expected scope, and violate user intent or policy assumptions about what the skill actually does.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The embedded execution instruction explicitly redirects this `marketing-video` skill to a different ecommerce-video template. That hidden indirection is dangerous because agents and users may trust the declared skill identity while actually invoking a different backend behavior, leading to unexpected processing, policy bypass by mislabeling, or accidental disclosure of assets to the wrong workflow.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: dlazy-marketing-video
version: 1.0.0
description: "marketing video, promo video, ad video, brand video — create a marketing / promo video from a product, brand, or brief. Use when the user wants a marketing, promotional, or advertising video for social or campaigns."
metadata: {"clawdbot":{"emoji":"🛒","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.1","installAlternative":"npx @dlazy/cli@1.2.1","homepage":"https://github.com/dlazyai/cli","source":"https://github.com/dlazyai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, run 'dlazy chat --skill product-to-ecommerce-video --prompt ...' for a new task, or 'dlazy chat --project <id> --prompt ...' to continue (discover ids via 'dlazy projects list'). Never pass both --skill and --project."}}
---
Confidence
82% confidence
Finding
create a marketing / promo video from a product, brand, or brief. Use when the user wants a marketing, promotional, or advertising video for social or campaigns." metadata: {"clawdbot":{"emoji":"🛒","r

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.