ClawHub
Back to skill

Security audit

Dlazy Audio音频生成

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for hosted audio generation, but its voice-cloning and local media upload workflows need careful review before use.

Review this skill before installing if you handle private media or voice recordings. Only provide files you are comfortable uploading to dLazy-hosted services, and only use voice-cloning workflows with clear permission from the speaker and for lawful, non-deceptive purposes. Prefer environment variables or the dlazy auth flow for API keys, and avoid sharing keys in chat.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The activation text is excessively broad and vague, which can cause an agent to invoke this skill in contexts beyond narrowly intended audio-generation tasks. Because the skill has `exec`, `read`, and `write` capabilities and can make remote API calls, ambiguous triggers increase the chance of unintended execution, data handling, or upload of user content without sufficiently specific user intent.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill routes local media inputs to hosted services, but the description does not prominently warn users at the point of use that local files will be uploaded off-device to `api.dlazy.com`/`files.dlazy.com`. In an agent context, this can lead to inadvertent exfiltration of sensitive local media, including private recordings or proprietary assets, especially since the skill is designed to accept local audio/image/video paths.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill advertises voice-cloning features without a clear warning about consent, impersonation risk, and the biometric sensitivity of voice samples. In context, this is more dangerous because the skill is specifically built to clone a speaker's voice and then reuse it for TTS, which can enable fraud, deception, privacy violations, or unauthorized replication of a person's biometric identity if used without explicit authorization.

Static analysis

No suspicious patterns detected.