快速视频生成 Veo 3.1 Fast

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 1:47 AM UTC
• Version: 1.3.15

Overview

This skill is a disclosed wrapper for dLazy video generation, with normal SaaS upload/API-key risks but no artifact-backed deception or malicious behavior.

Before installing, confirm you trust dLazy and the pinned @dlazy/cli package, prefer npx or another isolated execution path over global install, use the device-code login instead of pasting an API key into a shell command, and only pass media paths you intend to upload to dLazy's hosted service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unverified Third-Party npm Package Is Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5,51-62`; mirrored in `SKILL-cn.md:5,51-62` **Vulnerability Type**: Third-party dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When invoking this skill, use dlazy veo-3.1-fast -h for help."}} ``` ```markdown - **CLI source code**: [github.com/dlazy-ai/cli](https://github.com/dlazy-ai/cli) - **Maintainer**: dlazyai - **npm package**: `@dlazy/cli` (pinned to `1.2.3` in this skill's install spec) - **Homepage**: [dlazy.com](https://dlazy.com) You can install on demand without persisting a global binary by running: ```bash npx @dlazy/cli@1.2.3 <command> ``` Or, if you prefer a global install, the skill's `metadata.clawdbot.install` field declares the exact pinned version (`npm install -g @dlazy/cli@1.2.3`). ``` The equivalent installation instructions appear in `SKILL-cn.md`: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"当调用此技能时，可以使用 dlazy veo-3.1-fast -h 查看帮助信息。"}} ``` ```bash npx @dlazy/cli@1.2.3 <command> ``` ### Technical Analysis The Skill directs the host to retrieve and ex ...[truncated 2125 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Vendor and audit the exact CLI implementation required by the Skill, or provide a minimal implementation whose behavior is reviewable with the Skill. 2. Publish and verify a cryptographic integrity digest or signed provenance for the expected npm artifact before execution. 3. Use a lockfile and a trusted internal registry or package mirror with immutable artifacts. 4. Verify the correspondence between the reviewed Git source commit and the published npm package. 5. Avoid global installation. Run the package in an isolated, least-privilege environment with access limited to explicitly selected input and output files. 6. Disable npm lifecycle scripts where compatible, for example by using an appropriately controlled installation process with `--ignore-scripts`. 7. Restrict outbound network access to the documented endpoints and prevent the process from reading unrelated credentials or user files. 8. Document a process for dependency review, vulnerability monitoring, revocation, and controlled version upgrades. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:31
• Finding: API Key Can Be Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:31-39`; mirrored in `SKILL-cn.md:31-39` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Low ### Vulnerable Code From `SKILL.md`: ```markdown ### Alternative: Set the Key Manually If you already have an API key, you can save it directly: ```bash dlazy auth set YOUR_API_KEY ``` The CLI saves the key in your user config directory (`~/.dlazy/config.json` on macOS/Linux, `%USERPROFILE%\.dlazy\config.json` on Windows), with file permissions restricted to your OS user account. ``` The equivalent instruction in `SKILL-cn.md` is: ```markdown ### 备选：手动设置 API Key 如果你已有 API key，也可以直接保存： ```bash dlazy auth set YOUR_API_KEY ``` CLI 会把 key 保存在你的用户配置目录（macOS/Linux 上为 `~/.dlazy/config.json`，Windows 上为 `%USERPROFILE%\.dlazy\config.json`），文件权限仅限当前操作系统用户访问。 ``` ### Technical Analysis The documented command places the API key directly in the process argument vector. Depending on the operating system and host configuration, command-line arguments may be visible to other local processes, process-monitoring software, endpoint telemetry, audit systems, terminal capture tools, or diagnostic logs. The command can also be retained in shell history if the user replaces the placeholder directly on the command line. Restrictive permissions on the resulting configuration file do not prevent disclosure that occurs before or during command execution. The Skill recommends a device-code login as the primary authentication method, which reduces the likelihood of this issue. However, the documented manual alternative remains an unsafe secret-entry pattern. ### Attack Path 1. A user follows the manual authentication instructions and substitutes a real API key into `dlazy auth set YOUR_API_KEY`. 2. The shell records the command in history, or the operating system exposes the process argument vector while the command is running. 3. A local user, monitoring a ...[truncated 847 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove documentation that instructs users to place a real API key directly in a command-line argument. 2. Make the device-code login flow the exclusive recommended authentication method where possible. 3. If manual key entry is required, implement hidden interactive input that does not echo the secret or place it in the process argument vector. 4. Alternatively, accept the key through protected standard input or a securely permissioned temporary descriptor rather than through `argv`. 5. Avoid printing, logging, or returning the key in command output and error messages. 6. Preserve restrictive permissions on `~/.dlazy/config.json` and use atomic creation with user-only permissions from the moment the file is created. 7. Warn users to clear relevant shell history and rotate the key if it has previously been supplied as a command-line argument. 8. Ensure keys can be scoped to the minimum required API capabilities and maintain the documented rotation and revocation controls. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ae1

High

• Category: analysis-evasion

Content

[English](./SKILL.md) · [中文](./SKILL-cn.md)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger keywords include broad natural-language phrases like '快速生成视频' and '文生视频、图生视频', which can cause the skill to activate unintentionally in ordinary conversation. In an agent setting, accidental invocation can lead to unplanned network calls, uploads of local media paths, and consumption of paid API credits, making this more than a mere usability issue.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: 该技能整体文档在 L004、L013、L066-L070 明确声明用途是生成短视频，但输出示例在 L110-L113 给出的是 image/png 图片结果，而命令示例在 L126、L129 使用了前面帮助列表未声明的 --image 参数。这不是简单省略，而是文档内容彼此矛盾，会误导调用方对技能真实接口和产物类型的理解。

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## 错误处理

| Code | 错误类型                         | 示例信息                                                                                                                 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401  | 未授权 (API Key缺失或无效)       | `ok: false, code: "unauthorized", message: "API key is missing or invalid"`                                                              |
| 501  | 缺少必填参数                     | `error: required option '--prompt <prompt>' not specified`                                                               |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The listed triggers include generic phrases like "fast generate video" and especially "text to video, image to video," which overlap with common user requests rather than narrowly identifying this specific skill. The file does not provide scope constraints or negative examples clarifying when this skill should or should not activate.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## Error Handling

| Code | Error Type                         | Example Message                                                                                                          |
| ---- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401  | Unauthorized (No API Key)          | `ok: false, code: "unauthorized", message: "API key is missing or invalid"`                                                              |
| 501  | Missing required parameter         | `error: required option '--prompt <prompt>' not specified`                                                              |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Static analysis

No suspicious patterns detected.