ClawHub
Back to skill

Security audit

分镜脚本 Storyboard

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its stated dLazy video workflow, but it stores an API key locally and the reviewed CLI package does not enforce the user-only file permissions the skill claims.

Review this before installing if your machine is shared or multi-user. Use DLAZY_API_KEY per invocation or tighten permissions on ~/.dlazy/config.json if needed, avoid passing sensitive files with --files unless you intend to upload them to dLazy, and rotate or revoke the dLazy key if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger list includes “动画短片” as a standalone activation keyword. This is a broad content category rather than a narrowly scoped invocation phrase, so ordinary user requests about animated shorts could unintentionally match the skill without clear boundaries or exclusion conditions.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The markdown explains that the CLI automatically writes the API key to a local config file and later notes that files passed with `--files` are uploaded to `files.dlazy.com`. While these behaviors are described, the skill does not present a clear cautionary warning about credential storage and remote transmission of local content that could affect user privacy or system data handling.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.