ClawHub
Back to skill

Security audit

Dlazy Wan2.7

Security checks across malware telemetry and agentic risk

Overview

This video-generation skill is mostly coherent, but it needs Review because the referenced CLI can upload local media even on dry-run and stores API keys without the restrictive permissions the skill claims.

Review this before installing if you handle sensitive media or API keys. Use `npx @dlazy/cli@1.2.3` instead of a global install when possible, avoid `--dry-run` with private local files unless uploads are acceptable, and consider using `DLAZY_API_KEY` per invocation or manually restricting permissions on `~/.dlazy/config.json`.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger keyword includes the broad everyday phrase “视频生成” (“video generation”), which can cause the skill to activate in many ordinary conversations unrelated to this specific tool. Overbroad activation increases the chance that an agent invokes the skill unexpectedly, potentially sending user prompts or local media paths to external services without sufficiently explicit user intent.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger keyword 'video generation' is overly generic and can cause this skill to be selected for broad, unrelated user requests. That increases the chance an agent invokes a third-party CLI and uploads user-supplied local media or prompts to remote services unexpectedly, creating privacy, cost, and misrouting risks.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.