Plugin
ReviewAudited by ClawScan on May 12, 2026.
Overview
This plugin transparently wraps the dLazy CLI for media generation; its command execution, API-key use, and possible file uploads are disclosed and aligned with that purpose.
Install only if you are comfortable letting OpenClaw run the dLazy CLI for requested generation jobs. Confirm the dLazy CLI source/version, use an appropriate API key or logged-in account, and avoid passing local files or prompts that you do not want uploaded to dLazy.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent can start dLazy generation jobs with chosen parameters, which may spend credits or produce external outputs.
The plugin lets the agent build a dLazy CLI invocation from a model string and user-supplied flags. This is the intended wrapper behavior, but it is broad and should be used with user awareness.
const cliArgs = [model, ...flagify(argsObj)]; const result = await runDlazy(config, cliArgs, timeoutSeconds);
Review the model, prompt, files, and timeout before allowing expensive or sensitive generation runs.
If a local file path is provided, that file may be sent to dLazy's servers for processing.
The skill discloses that local media paths supplied as tool arguments may be uploaded to the hosted provider. This is expected for cloud media generation, but users should be aware of the data flow.
Any local file paths you pass to image / video / audio fields are uploaded to dLazy's media storage (`files.dlazy.com`)
Only pass files you intend to upload to dLazy, and avoid private or regulated data unless your policy allows it.
Runs may use your dLazy organization credentials and credits.
The plugin can use a dLazy API key or the CLI's local login config. This credential use is documented and purpose-aligned, but it grants access to the user's dLazy account.
"apiKey": {
"type": "string",
"description": "Optional dLazy API key. If set, exported as DLAZY_API_KEY for each call. Otherwise the CLI uses its own config (~/.dlazy/config.json) from `dlazy login`."Use a key/account with appropriate spending limits, and rotate or revoke the key from dLazy if access is no longer needed.
A compromised or unexpected `dlazy` binary on PATH would be what the plugin executes.
Runtime behavior depends on an external CLI installed on the user's PATH. This is disclosed and central to the plugin, but users should ensure they install a trusted version.
npm install -g @dlazy/cli dlazy login
Install dLazy CLI from the official source, prefer the pinned version documented in SKILL.md where possible, and verify which `dlazy` binary is on PATH.