ClawHub
Back to skill

Security audit

视频图片仿制 Video Image Replicate

Security checks across malware telemetry and agentic risk

Overview

The skill’s main purpose is clear, but it uploads user files to dLazy and persists credentials/session data with some privacy and local-permission concerns.

Review the dLazy CLI before installing, use npx or DLAZY_API_KEY if you do not want a persistent global binary or saved key, confirm the target project before continuing prior work, and avoid attaching private files unless you intend to upload them to dLazy.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list includes broad, everyday terms such as “复刻”, “同款”, and “replicate”, which can match common user requests outside the intended scope. This can cause accidental invocation of the skill, sending user prompts and attached files to the external dLazy service without sufficiently explicit user intent, creating privacy and workflow-integrity risk.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: dlazy-video-image-replicate
version: 1.3.5
description: "replicate this image, remake this video, recreate a reference, same video with my content, 同款视频, 照着做 — study the reference image or video the user provides, then recreate the same look and structure with the user's own subject, product, or characters."
metadata: {"clawdbot":{"emoji":"🔁","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazyai/cli","source":"https://github.com/dlazyai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]},"openclaw":{"systemPrompt":"When this skill is called, run 'dlazy chat --skill video-image-replicate --prompt ...' for a new task, or 'dlazy chat --project <id> --prompt ...' to continue (discover ids via 'dlazy projects list'). Never pass both --skill and --project."}}
---
Confidence
88% confidence
Finding
create a reference, same video with my content, 同款视频, 照着做 — study the reference image or video the user provides, then recreate the same look and structure with the user's own subject, product, or cha

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.