Dlazy Imageseg

Image matting tool: separates foreground from background and returns transparent background URL, suitable for product image processing, character cutout, and...

Security Scan

The skill largely matches an image-matting CLI client, but there are packaging/instruction inconsistencies and a few undeclared references (API key env var, mismatched versions) and it will upload user files and require an API key — review before installing or using with sensitive images.

Purpose & Capability

The name/description match the instructions: this is a thin CLI client that calls dLazy's image-segmentation API. Requiring npm/npx and offering an npm install or npx invocation is coherent. However metadata and SKILL.md show inconsistent version numbers (registry lists 1.0.5, SKILL.md header 1.0.3, install pinned to 1.0.6), which is sloppy and worth validating against the upstream repo/npm.

Instruction Scope

SKILL.md's runtime instructions are narrowly scoped to running the dlazy CLI and handling its standard flags/errors. The file documents that local files passed as inputs are uploaded to oss.dlazy.com and that prompts/params are sent to api.dlazy.com — expected for a cloud SaaS client. No instructions request unrelated system files or extra credentials. The document does contain strong 'MUST' directives for how an agent should inform users about balance/authorization errors; those are prescriptive but within scope.

Install Mechanism

This is an instruction-only skill (no install executed by the platform). The suggested install is npm install -g @dlazy/cli@1.0.6 or npx @dlazy/cli@1.0.6, both pointing to a named npm package and GitHub repo. That is a standard install mechanism; no arbitrary download URLs or extract operations are present. Still, the registry/skill version mismatch should be double-checked before installing.

Credentials

SKILL.md states that the dLazy API key is required and that it can be supplied via the DLAZY_API_KEY environment variable or saved to ~/.dlazy/config.json, but the registry's declared required env vars list is empty — the skill references an env var that isn't declared. More importantly, using this skill will upload input images to a third-party host (oss.dlazy.com) and requires an API key stored locally; both are expected for the service but are sensitive operations. Ensure you trust dLazy before sending private images or storing keys on the host machine.

Persistence & Privilege

The skill does not request always:true, does not include an install that the platform will auto-run, and does not request extra system privileges. It does instruct use of a CLI which, when installed/run, will store an API key in the user's config directory — normal for CLI tools. Autonomous invocation by the agent is allowed (platform default) but not combined here with elevated persistence.

What to consider before installing

This skill appears to be a thin client for the dLazy imageseg API and is coherent with that purpose, but you should: 1) Verify the upstream project (https://github.com/dlazyai/cli) and the npm package @dlazy/cli before installing — the skill files show mismatched version numbers (1.0.3 / 1.0.5 / install pinned to 1.0.6). 2) Prefer using npx for one-off runs if you don't want a global install. 3) Be aware any local image files you pass will be uploaded to oss.dlazy.com and outputs hosted there — do not use this with private/sensitive images unless you accept that. 4) The skill references the DLAZY_API_KEY env var but the registry metadata doesn't declare it; you will need to supply and manage that API key yourself. 5) If you proceed, review the CLI source code and privacy/security docs on dlazy.com and rotate/revoke API keys if you stop using the service.

English · 中文

Image matting tool: separates foreground from background and returns transparent background URL, suitable for product image processing, character cutout, and composition.

Trigger Keywords

• imageseg

Authentication

All requests require a dLazy API key, configured through the CLI:

dlazy auth set YOUR_API_KEY

The CLI saves the key in your user config directory (~/.dlazy/config.json on macOS/Linux, %USERPROFILE%\.dlazy\config.json on Windows), with file permissions restricted to your OS user account. You can also supply the key per-invocation via the DLAZY_API_KEY environment variable.

Getting Your API Key

1. Sign in or create an account at dlazy.com
2. Go to dlazy.com/dashboard/organization/api-key
3. Copy the key shown in the API Key section

Each key is scoped to your dLazy organization and can be rotated or revoked at any time from the same dashboard.

About & Provenance

• CLI source code: github.com/dlazyai/cli
• Maintainer: dlazyai
• npm package: @dlazy/cli (pinned to 1.0.6 in this skill's install spec)
• Homepage: dlazy.com

You can install on demand without persisting a global binary by running:

npx @dlazy/cli@1.0.6 <command>

Or, if you prefer a global install, the skill's metadata.clawdbot.install field declares the exact pinned version (npm install -g @dlazy/cli@1.0.6). Review the GitHub source before installing.

How It Works

This skill is a thin client over the dLazy hosted API. When you invoke it:

• Prompts and parameters you provide are sent to the dLazy API endpoint (api.dlazy.com) for inference.
• Any local file paths you pass to image / video / audio fields are uploaded to dLazy's media storage (oss.dlazy.com) so the model can read them — the same flow as any cloud-based generation API.
• Generated output URLs returned by the API are hosted on oss.dlazy.com.

This is the standard SaaS pattern; the skill itself does not access network or filesystem resources beyond what the dLazy CLI already handles. See dlazy.com for the full service terms.

Usage

CRITICAL INSTRUCTION FOR AGENT: Execute dlazy imageseg to get the result.

dlazy imageseg -h

Options:
  --image <image>                      Image (URL) [image: url or local path]
  --input <spec>                       JSON payload: inline string, @file, or - (stdin)
  --dry-run                            Print payload + cost estimate without calling API
  --no-wait                            Return generateId immediately for async tasks
  --timeout <seconds>                  Max seconds to wait for async completion (default: "1800")
  -h, --help                           display help for command

Output Format

{
  "ok": true,
  "kind": "urls",
  "data": {
    "urls": [
      "https://oss.dlazy.com/result.mp4"
    ]
  }
}

Examples

dlazy imageseg --prompt 'prompt content' 

Error Handling

Code	Error Type	Example Message
401	Unauthorized (No API Key)	ok: false, code: "unauthorized", message: "API key is missing or invalid"
501	Missing required parameter	error: required option '--prompt <prompt>' not specified
502	Local file read error	Error: Image file/Video file not found: C:\path\to\your\file
503	API request failed (no balance)	ok: false, code: "insufficient_balance"
503	API request failed (server error)	HTTP status code error (500 server crash)
504	Asynchronous task execution failed	=== Generation Failed === / {Specific error reason returned by backend, for example "Prompt violates safety policy"}

AGENT CRITICAL INSTRUCTION:

1. If the execution result returns code: "insufficient_balance", you MUST explicitly inform the user that their credits are insufficient and guide them to recharge: https://dlazy.com/dashboard/organization/settings?tab=credits
2. If the execution result returns code: "unauthorized" or indicates missing API key, you MUST inform the user to get their API key from https://dlazy.com/dashboard/organization/api-key and save it using dlazy auth set <key> and resume the task.

Tips

Visit https://dlazy.com for more information.