ClawHub
Back to skill

Security audit

音频免费版

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed text-to-speech helper that uses the dlazy CLI and writes expected audio output files locally.

Install only if you are comfortable configuring a dlazy API key and sending the text you want voiced to dlazy's API. Run output commands in a dedicated folder or choose explicit output paths to avoid overwriting existing MP3 files.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Low
Confidence
83% confidence
Finding
The documented commands write output files locally using paths like `intro.mp3` without explicitly warning that invoking the skill modifies the local filesystem. In agent environments with `exec` and `write` capabilities, silent file creation can surprise users, overwrite existing files, or place artifacts in unintended working directories.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.