Security audit
Security checks for vulnerabilities and agentic risk
This skill is a plausible cloud media-generation wrapper, but its broad activation, external file uploads, executable CLI use, and locally persisted API key need user review before installation.
Install only if you intend to use dLazy as a cloud media-generation service. Treat prompts and any referenced local files as data that may be uploaded to dLazy-hosted endpoints, avoid sensitive or unauthorized media, and prefer an explicit per-session DLAZY_API_KEY if you do not want credentials saved under your home directory. Review the exact @dlazy/cli version before global installation because the skill text has version/provenance inconsistencies.
The skill gives conflicting authentication guidance: one section says all requests require a dLazy API key and describes storing it locally, while a later section says no extra API key is needed unless explicitly noted. This can mislead an agent or user into mishandling credentials, skipping required auth steps, or persisting secrets without informed consent.
The skill claims it is not suitable for copyrighted media processing, yet it advertises capabilities such as dubbing, lip-sync, replication, segmentation, and transformation of user-supplied media that are commonly applied to copyrighted works. This mismatch can cause unsafe or policy-violating use by understating the real scope and risk of the tool.
The trigger keyword 'generate' is so broad that it is likely to match many ordinary user requests and activate this skill unexpectedly. In this context, unexpected activation is risky because the skill can invoke exec-capable CLI commands and route user data or local files to external hosted services.
The authentication guidance says the CLI automatically saves the user's API key to local config, but the skill does not prominently warn about credential persistence, local secret exposure, or shared-environment risk. In agent environments, this can leave reusable API credentials on disk without clear user awareness.
No suspicious patterns detected.
