Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Dlazy Seedance 2.0 Fast

v1.0.4

Fast version of ByteDance's Seedance 2.0. Generates videos faster with support for multi-modal references, first/last frame, and text-to-video.

0· 464·1 current·1 all-time
bydlazy@dlazyai

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dlazyai/dlazy-seedance-2-0-fast.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Dlazy Seedance 2.0 Fast" (dlazyai/dlazy-seedance-2-0-fast) from ClawHub.
Skill page: https://clawhub.ai/dlazyai/dlazy-seedance-2-0-fast
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: npm, npx
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install dlazy-seedance-2-0-fast

ClawHub CLI

Package manager switcher

npx clawhub@latest install dlazy-seedance-2-0-fast
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description describe a CLI client for a hosted video-generation API; the declared requirements (npm, npx) and the CLI workflow (calling api.dlazy.com and uploading media to oss.dlazy.com) match that purpose. However, the SKILL files contain inconsistent version/provenance metadata (skill registry shows version 1.0.4, SKILL.md header is 1.0.2, metadata.install pins @dlazy/cli@1.0.6) and the description references 'ByteDance's Seedance' while the package/URLs reference dlazy/dlazyai, which could be sloppy documentation or misattribution.
Instruction Scope
Runtime instructions are narrowly scoped: run the dlazy CLI, pass prompts, and (if you give local file paths) the CLI uploads media to the service. The SKILL explicitly documents where API requests and uploads go (api.dlazy.com, oss.dlazy.com) and the CLI stores an API key at ~/.dlazy/config.json. The instructions do not ask the agent to read unrelated system files or exfiltrate arbitrary data beyond media you provide.
Install Mechanism
This is an instruction-only skill (no install spec enforced), but the embedded metadata recommends installing a pinned npm package (@dlazy/cli@1.0.6) or using npx. Installing an npm CLI runs third-party code on your machine — a normal pattern for this use case but a moderate-risk install mechanism. The package is on the public npm registry (npmjs.com) and the SKILL points to a GitHub repo; you should review that source before installing. The registry/in-document version mismatches are worth verifying.
Credentials
No required environment variables are declared by the registry; the SKILL.md documents an optional DLAZY_API_KEY or using 'dlazy auth set' which stores credentials in ~/.dlazy/config.json. Requesting a single service API key is proportionate to a hosted-API CLI client. No unrelated credentials or config paths are requested.
Persistence & Privilege
The skill does not request always:true and is user-invocable only. The only persistence behavior described is the CLI storing an API key in the user's config (~/.dlazy/config.json), which is expected for a CLI that needs an API key.
What to consider before installing
This skill appears to be a thin CLI client for a hosted dLazy video API, which is coherent with its description — but take these precautions before installing or using it: 1) Verify the npm package and GitHub repository (review source code) — the SKILL contains inconsistent version/provenance information (1.0.2 / 1.0.4 / 1.0.6) that should be resolved. 2) Prefer using npx for one-off runs (npx @dlazy/cli@1.0.6 ...) instead of a global npm install to reduce persistence. 3) Be aware the CLI will upload any local media paths you provide to oss.dlazy.com and will store your API key at ~/.dlazy/config.json (or read DLAZY_API_KEY if supplied) — only provide files and keys you trust. 4) Confirm the service domains (api.dlazy.com, oss.dlazy.com) and the publisher identity before giving your API key or installing the package. 5) If you need higher assurance, ask the publisher for a signed release or audit the package code on GitHub before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🤖 Clawdis
Binsnpm, npx
latestvk97av2ayyazpq3zz97tg4409k985ngx4
464downloads
0stars
5versions
Updated 22h ago
v1.0.4
MIT-0

dlazy-seedance-2.0-fast

English · 中文

Fast version of ByteDance's Seedance 2.0. Generates videos faster with support for multi-modal references, first/last frame, and text-to-video.

Trigger Keywords

  • seedance-2.0-fast

Authentication

All requests require a dLazy API key, configured through the CLI:

dlazy auth set YOUR_API_KEY

The CLI saves the key in your user config directory (~/.dlazy/config.json on macOS/Linux, %USERPROFILE%\.dlazy\config.json on Windows), with file permissions restricted to your OS user account. You can also supply the key per-invocation via the DLAZY_API_KEY environment variable.

Getting Your API Key

  1. Sign in or create an account at dlazy.com
  2. Go to dlazy.com/dashboard/organization/api-key
  3. Copy the key shown in the API Key section

Each key is scoped to your dLazy organization and can be rotated or revoked at any time from the same dashboard.

About & Provenance

You can install on demand without persisting a global binary by running:

npx @dlazy/cli@1.0.6 <command>

Or, if you prefer a global install, the skill's metadata.clawdbot.install field declares the exact pinned version (npm install -g @dlazy/cli@1.0.6). Review the GitHub source before installing.

How It Works

This skill is a thin client over the dLazy hosted API. When you invoke it:

  • Prompts and parameters you provide are sent to the dLazy API endpoint (api.dlazy.com) for inference.
  • Any local file paths you pass to image / video / audio fields are uploaded to dLazy's media storage (oss.dlazy.com) so the model can read them — the same flow as any cloud-based generation API.
  • Generated output URLs returned by the API are hosted on oss.dlazy.com.

This is the standard SaaS pattern; the skill itself does not access network or filesystem resources beyond what the dLazy CLI already handles. See dlazy.com for the full service terms.

Usage

CRITICAL INSTRUCTION FOR AGENT: Execute dlazy seedance-2.0-fast to get the result.

dlazy seedance-2.0-fast -h

Options:
  --prompt <prompt>                    Prompt
  --generation_mode <generation_mode>  Generation Mode [default: components] (choices: "components", "frames")
  --images <images...>                 Images [image: url or local path] (max 9) [hidden when generation_mode="frames"]
  --videos <videos...>                 Videos [video: url or local path] (max 3) [hidden when generation_mode="frames"]
  --audios <audios...>                 Audios [audio: url or local path] (max 3) [hidden when generation_mode="frames"]
  --firstFrame <firstFrame>            First Frame [image: url or local path] [only when generation_mode="frames"]
  --lastFrame <lastFrame>              Last Frame [image: url or local path] [only when generation_mode="frames"]
  --resolution <resolution>            Resolution [default: 720p] (choices: "480p", "720p")
  --ratio <ratio>                      Aspect Ratio [default: adaptive] (choices: "16:9", "4:3", "1:1", "3:4", "9:16", "21:9", "adaptive")
  --duration <duration>                Duration (s) [default: 5] (choices: "4", "5", "6", "7", "8", "9", "10", "11", "12")
  --generate_audio <generate_audio>    Generate Audio [default: true]
  --input <spec>                       JSON payload: inline string, @file, or - (stdin)
  --dry-run                            Print payload + cost estimate without calling API
  --no-wait                            Return generateId immediately for async tasks
  --timeout <seconds>                  Max seconds to wait for async completion (default: "1800")
  -h, --help                           display help for command

Output Format

{
  "ok": true,
  "kind": "urls",
  "data": {
    "urls": [
      "https://oss.dlazy.com/result.mp4"
    ]
  }
}

Examples

dlazy seedance-2.0-fast --prompt 'prompt content' 

Error Handling

CodeError TypeExample Message
401Unauthorized (No API Key)ok: false, code: "unauthorized", message: "API key is missing or invalid"
501Missing required parametererror: required option '--prompt <prompt>' not specified
502Local file read errorError: Image file/Video file not found: C:\path\to\your\file
503API request failed (no balance)ok: false, code: "insufficient_balance"
503API request failed (server error)HTTP status code error (500 server crash)
504Asynchronous task execution failed=== Generation Failed === / {Specific error reason returned by backend, for example "Prompt violates safety policy"}

AGENT CRITICAL INSTRUCTION:

  1. If the execution result returns code: "insufficient_balance", you MUST explicitly inform the user that their credits are insufficient and guide them to recharge: https://dlazy.com/dashboard/organization/settings?tab=credits
  2. If the execution result returns code: "unauthorized" or indicates missing API key, you MUST inform the user to get their API key from https://dlazy.com/dashboard/organization/api-key and save it using dlazy auth set <key> and resume the task.

Tips

Visit https://dlazy.com for more information.

Comments

Loading comments...