视频翻译配音 Video Translate & Dub

• Outcome: Review
• Latest audit: Nov 13, 2026 · 1:36 AM UTC
• Version: 1.0.32

Overview

ClawScan marks this skill suspicious because the scanners report a strong risk of existing files being overwritten without warning, alongside concerns about credential storage and fixed translation instructions.

The verdict is suspicious, which means the scanners found real concerns but do not establish malicious intent. Before installing, consider whether you are comfortable with the reported risk of overwriting existing files and with login storing an API key outside the working directory. Scanner coverage was partial because several local references could not be resolved, so the evidence is incomplete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

The workspace-only filesystem assurance contradicts authentication commands that persist credentials outside the workspace.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

L068 states that no files outside the user-designated working directory will be touched. However, the prescribed authentication commands at L030 and L040 explicitly save an API key to the user-level configuration file, identified at L043 as ~/.dlazy/config.json or its Windows equivalent. Although credential persistence is appropriate and disclosed elsewhere, it contradicts the unconditional filesystem-boundary assurance.

Content

No source excerpt is available for this finding.

The workflow silently overwrites existing files without warning the user.

Medium

• Category: Output Handling
• Confidence: 98% confidence

Finding

The workflow runs in the directory containing the user's video and uses predictable output names with ffmpeg's overwrite flag and shell output redirection. Existing audio, transcripts, or generated deliverables with those names can therefore be destroyed without confirmation, even during an otherwise legitimate translation request.

Content

No source excerpt is available for this finding.

The translation prompt semantically nullifies a server-added instruction by redefining its scope.

Medium

• Category: Prompt Injection
• Confidence: 88% confidence

Finding

The skill explicitly describes neutralizing the server's English-output instruction. Rather than directly telling the model to ignore it, the supplied prompt reinterprets any English-only instruction as applying exclusively to commentary, then prohibits commentary altogether—a semantic workaround that defeats the instruction while appearing to reconcile it.

Content

No source excerpt is available for this finding.

The translation prompt mandates Simplified Chinese without requiring the user's choice of that target language.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The workflow instructs the agent to use a prompt that explicitly requires every translation to be in Simplified Chinese. The skill otherwise advertises translation into a target language and accepts general video-translation triggers, without restricting this prompt to users who selected Simplified Chinese.

Content

No source excerpt is available for this finding.

The workflow overwrites existing files without warning or confirmation.

Medium

• Category: Output Handling
• Confidence: 98% confidence

Finding

Predictable filenames are written directly into the user's video directory using ffmpeg's overwrite flag and truncating shell redirections. Following the workflow can silently destroy pre-existing files such as track.wav or asr.json, creating a concrete data-integrity and availability risk.

Content

No source excerpt is available for this finding.

The translation prompt mandates Simplified Chinese without requiring user selection.

Medium

• Category: Output Handling
• Confidence: 97% confidence

Finding

The prescribed prompt requires every translation to be in Simplified Chinese, while the skill also activates for general video and subtitle translation requests. It does not ask the user to choose a target language or restrict invocation to requests explicitly selecting Simplified Chinese.

Content

No source excerpt is available for this finding.

The working-directory-only filesystem assurance contradicts the authentication instructions, which persist an API key in the user's home directory.

Low

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

L068 states that nothing else touches the filesystem beyond the chosen working directory. However, the prescribed dlazy login and dlazy auth set commands (L030–L043) explicitly save an API key to a user-level configuration file outside that directory, contradicting the stated filesystem boundary for security-sensitive persistent state.

Content

No source excerpt is available for this finding.