Security audit
Dlazy Video Replicate
Security checks across malware telemetry and agentic risk
Overview
The skill appears purpose-aligned, but it stores a dLazy API key locally and the packaged CLI does not clearly enforce the restrictive file permissions claimed by the skill.
Review before installing if the dLazy API key controls paid credits or sensitive account access. Prefer per-invocation DLAZY_API_KEY when possible, or verify and restrict ~/.dlazy/config.json permissions after login; only pass media files you intend to upload to dLazy.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.