Dlazy Webtoon Adapter

• Outcome: Review
• Latest audit: Jul 21, 2026 · 5:02 AM UTC
• Version: 1.3.5

Overview

This skill mixes a webtoon writing workflow with a separate terminal-based image generation tool that stores an API key and sends prompts or media to dLazy services.

Install only if you intentionally want a dLazy CLI-backed image generation workflow in addition to webtoon writing. Review the npm package and be comfortable with a global CLI, a stored dLazy API key, prompts sent to dLazy, and any referenced local media being uploaded before using generation commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill content presents itself as a webtoon-adaptation writing workflow, but later introduces a separate terminal-driven image-generation execution path using the dlazy CLI. This capability mismatch is dangerous because it can mislead a user or orchestrator into approving command execution and networked data transfer that are not necessary for the declared writing-only purpose, increasing the chance of unintended tool use and secret exposure.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The skill claims it cannot read or write local files, yet its own setup instructions direct use of a CLI that persists API keys to local configuration files. This inconsistency is risky because it obscures credential storage behavior and may cause users to underestimate local secret persistence and the security implications of installing and authenticating the tool.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill instructs the agent to execute terminal commands and perform remote image generation even though the stated skill purpose is webtoon adaptation writing. Unnecessary command execution and uploads to external services expand the attack surface, can expose user content to third parties, and may cause an agent to run networked tooling that the user did not reasonably expect from this skill.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill mixes a webtoon-adaptation workflow with unrelated image-generation and terminal-execution instructions, creating a confused-deputy risk where an agent may perform actions outside the declared purpose. This broadens the operational scope to command execution and external API use without clear necessity or isolation, increasing the chance of unintended or unsafe behavior.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to execute terminal commands for image generation even though the stated skill purpose is webtoon adaptation, not shell-based rendering. Unjustified command execution introduces unnecessary remote interaction, package/tool dependency risk, and possible misuse of agent execution privileges if the skill is triggered in the wrong context.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The document claims the skill cannot read or write local files, yet elsewhere it describes writing API keys to local config files and uploading local media paths through the CLI. This contradiction can mislead reviewers and users about actual data-handling behavior, undermining informed consent and making sensitive local or credential-related operations less visible.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.