ClawHub
Back to skill

Security audit

Dlazy Generate

Security checks across malware telemetry and agentic risk

Overview

This skill is a plausible cloud media-generation wrapper, but its broad activation, external file uploads, executable CLI use, and locally persisted API key need user review before installation.

Install only if you intend to use dLazy as a cloud media-generation service. Treat prompts and any referenced local files as data that may be uploaded to dLazy-hosted endpoints, avoid sensitive or unauthorized media, and prefer an explicit per-session DLAZY_API_KEY if you do not want credentials saved under your home directory. Review the exact @dlazy/cli version before global installation because the skill text has version/provenance inconsistencies.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill gives conflicting authentication guidance: one section says all requests require a dLazy API key and describes storing it locally, while a later section says no extra API key is needed unless explicitly noted. This can mislead an agent or user into mishandling credentials, skipping required auth steps, or persisting secrets without informed consent.

Intent-Code Divergence

Medium
Confidence
82% confidence
Finding
The skill claims it is not suitable for copyrighted media processing, yet it advertises capabilities such as dubbing, lip-sync, replication, segmentation, and transformation of user-supplied media that are commonly applied to copyrighted works. This mismatch can cause unsafe or policy-violating use by understating the real scope and risk of the tool.

Vague Triggers

High
Confidence
95% confidence
Finding
The trigger keyword 'generate' is so broad that it is likely to match many ordinary user requests and activate this skill unexpectedly. In this context, unexpected activation is risky because the skill can invoke exec-capable CLI commands and route user data or local files to external hosted services.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The authentication guidance says the CLI automatically saves the user's API key to local config, but the skill does not prominently warn about credential persistence, local secret exposure, or shared-environment risk. In agent environments, this can leave reusable API credentials on disk without clear user awareness.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.