LrshuAI Text To Image

• Analyzed: Apr 3, 2026, 7:26 AM
• Findings: 1
• Version: 1.0.1
• Hash: 8b112c6db3835277d8536e9c20e6156caf31cd071831d7ff9d8c6b9ba5ed78c5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a Python script (`script/invoke_model.py`) that encodes local files into base64 and transmits them along with environment-stored API keys to a remote endpoint (dlazy.com). Most notably, the `SKILL.md` file contains a 'CRITICAL INSTRUCTION' explicitly directing the AI agent to bypass the standard `openclaw run` execution method in favor of direct system calls. This attempt to circumvent the framework's standard execution path, combined with the capability to read and exfiltrate local file data, poses a risk of evading security controls or logging.