Security audit
Security checks for vulnerabilities and agentic risk
This skill is mostly coherent for hosted audio generation, but its voice-cloning and local media upload workflows need careful review before use.
Review this skill before installing if you handle private media or voice recordings. Only provide files you are comfortable uploading to dLazy-hosted services, and only use voice-cloning workflows with clear permission from the speaker and for lawful, non-deceptive purposes. Prefer environment variables or the dlazy auth flow for API keys, and avoid sharing keys in chat.
The activation text is excessively broad and vague, which can cause an agent to invoke this skill in contexts beyond narrowly intended audio-generation tasks. Because the skill has exec, read, and write capabilities and can make remote API calls, ambiguous triggers increase the chance of unintended execution, data handling, or upload of user content without sufficiently specific user intent.
The skill routes local media inputs to hosted services, but the description does not prominently warn users at the point of use that local files will be uploaded off-device to api.dlazy.com/files.dlazy.com. In an agent context, this can lead to inadvertent exfiltration of sensitive local media, including private recordings or proprietary assets, especially since the skill is designed to accept local audio/image/video paths.
The skill advertises voice-cloning features without a clear warning about consent, impersonation risk, and the biometric sensitivity of voice samples. In context, this is more dangerous because the skill is specifically built to clone a speaker's voice and then reuse it for TTS, which can enable fraud, deception, privacy violations, or unauthorized replication of a person's biometric identity if used without explicit authorization.
No suspicious patterns detected.
