LrshuAI Text To Speech

• Analyzed: Apr 3, 2026, 7:26 AM
• Findings: 1
• Version: 1.0.0
• Hash: 463e6d4e7f9342574bcd99d328f10822f4c6fe5d6b0ad1e75c9241c5da044d7f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a prompt injection in SKILL.md that explicitly instructs the AI agent to bypass the standard 'openclaw run' execution path and instead run the Python script directly, which may be an attempt to evade platform-level monitoring or sandboxing. The script 'script/invoke_model.py' sends the user's 'TEAM_API_KEY' to a third-party endpoint (dlazy.com), and while this appears to be the intended API gateway, the combination of bypassing standard protocols and using a non-standard backend is a significant security risk.