Dlazy Search Audio

• Outcome: Review
• Latest audit: Jul 21, 2026 · 9:04 AM UTC
• Version: 1.3.6

Overview

This appears to be a real dLazy audio-search wrapper, but its documentation mixes the narrow search task with broader file upload, generation, async, and local save behavior that users should review first.

Review the skill before installing because it uses a dLazy API key and a general-purpose dLazy CLI. For this skill, prefer npx @dlazy/cli@1.2.3 search_audio with --query, avoid passing local files or --input @path unless you intend to send that data to dLazy, and use --save only when you explicitly want to download a returned audio URL.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The documented interface for a narrowly scoped audio-search skill exposes broader CLI behaviors such as async job handling and local file download via --save. That expands the operational surface beyond simple metadata retrieval and can mislead an agent into performing file writes or interacting with generic job flows not necessary for this skill’s stated purpose.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The example and error documentation refer to --prompt and image/video file handling, which do not match an audio search tool. This inconsistency can cause agents to supply unintended inputs or believe local media uploads are supported, increasing the risk of accidental data disclosure or execution of a more capable backend path than users expect.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The working-principle section says local image/video/audio paths may be uploaded to remote storage, contradicting the stated purpose of searching Pixabay Music and returning URLs/metadata. For a search-only skill, documenting local file upload creates an unexpected data exfiltration path and weakens user consent because agents may transmit local content to external services unnecessarily.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill is presented as a narrow Pixabay music search tool, but its documentation discloses broader dLazy SaaS behaviors including remote inference, file uploads, and hosted output handling. This mismatch undermines informed consent and can cause an agent or user to provide data under false assumptions about the tool's scope.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill documentation states that local file paths passed to media fields may be uploaded to remote storage and that results can be saved locally, even though the stated purpose is only audio search. Unnecessary file ingress/egress expands the attack surface and creates a risk of exfiltrating local data or writing untrusted remote content to disk through a tool the user may believe is harmless.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The examples and error messages reference `--prompt` and image/video file handling, which contradict the documented interface of an audio search query tool. Such interface confusion is dangerous because agents may invoke unintended code paths or supply broader inputs than expected, increasing the chance of accidental data disclosure or misuse of unrelated backend features.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.