dlazy-videoseg@1.3.34

CAUTION

Publisher claims: "Video human segmentation tool: invokes Aliyun's async SegmentVideoBody and returns a same-length black/white mask video, suitable for downstream compositing or matting. 视频人像分割工具：调用阿里云 SegmentVideoBody 异步任务，返回与原视频同时长的 mask 视频（黑白蒙版），可用于后续合成或抠像处理。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher dlazyai · joined 2 days agoInstalls 3,427Last detonated 41 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Fake instruction boundary tagSKILL.md:124 · Fake instruction boundary tag

AST01

HIGH

URL with embedded credentialsSKILL-cn.md:5 · URL with embedded credentials — may be phishing or credential leaking

AST07

CRITICAL

Fake instruction boundary tagSKILL-cn.md:124 · Fake instruction boundary tag

AST01

HIGH

npx invocation of non-well-known packageSKILL-cn.md:5 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL-cn.md:57 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

URL with embedded credentialsSKILL.md:5 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

npx invocation of non-well-known packageSKILL.md:5 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:57 · npx invocation of non-well-known package — may execute untrusted code

AST06