Dlazy Mj.Imagine

Generate artistic images using Midjourney (MJ) model. Supports text-to-image.

Security Scan

The skill is plausibly a thin CLI wrapper for a cloud image-generation service, but the metadata/instructions mismatch (API key & config path required but not declared) and the fact it directs the agent to run npm/npx-installed code and upload user files raises proportionality and execution risks you should review before installing.

Purpose & Capability

Name/description (Midjourney-style text-to-image) aligns with the content: the skill is a thin client that calls dLazy's API and returns hosted URLs. Requiring npm/npx to run the published @dlazy/cli is reasonable for this purpose.

Instruction Scope

Runtime instructions stay within the stated purpose: they tell the agent to run `dlazy mj.imagine` and explain authentication and upload behavior. However, the skill will upload any local file paths supplied to oss.dlazy.com — the agent must not be permitted to inject arbitrary local paths (sensitive files could be uploaded). The SKILL instructs the agent to notify users about insufficient balance or missing API key, which is expected but prescriptive.

Install Mechanism

No registry-level install spec exists, but the SKILL metadata proposes installing `@dlazy/cli@1.0.6` via npm or using `npx`. Installing or running an npm package executes third-party code: this is traceable (npm + GitHub repo provided) but still a moderate execution risk — review the package source on GitHub and npm before running or installing globally.

Credentials

The SKILL.md clearly requires a DLAZY API key and documents config storage at `~/.dlazy/config.json` or via `DLAZY_API_KEY`, but the registry metadata declared no required env vars or config paths. This mismatch is concerning: the skill needs a secret (API key) and will store/read it from your user config, yet that requirement isn't surfaced by the registry. Requesting an API key for the service itself would be proportionate — the problem is the registry omission and the implicit access to your user config file.

Persistence & Privilege

The skill is not force-enabled (always:false) and allows normal autonomous invocation (platform default). That combination is typical. However, because the skill instructs running npm/npx code and can upload local files, autonomous invocation increases risk: an agent that runs this skill with an API key could upload files or execute remote package code without additional prompts. No evidence the skill modifies other skills or system-wide settings.

What to consider before installing

This skill appears to be a legitimate CLI wrapper for a cloud image-generation service, but take these precautions before installing or granting it credentials: - Inspect the upstream project: review the @dlazy/cli source on GitHub and the npm package contents (version pinned to 1.0.6) before running npm install -g or npx. - Treat the API key as sensitive: the CLI will store it at ~/.dlazy/config.json or accept DLAZY_API_KEY. The registry metadata failing to list this is an omission — only provide a key you control and can revoke (use a limited-scope or ephemeral key if possible). - Do not let the agent or skill select local file paths automatically. Any local path you pass will be uploaded to oss.dlazy.com; avoid passing sensitive files. - Prefer running commands manually (npx @dlazy/cli@1.0.6 ...) to verify behavior and outputs before allowing an agent to invoke the skill autonomously. - If you must enable the skill, monitor usage, and be prepared to rotate/revoke the API key if anything unexpected happens. Additional info that would raise confidence: explicit registry declaration of required env vars/config paths (DLAZY_API_KEY and ~/.dlazy/config.json) and a verified link to a reproducible package release. If you want, I can fetch and summarize the GitHub repo and npm package manifest (if publicly available) before you install.

English · 中文

Generate artistic images using Midjourney (MJ) model. Supports text-to-image.

Trigger Keywords

• midjourney
• mj
• generate image, artistic painting
• text to image

Authentication

All requests require a dLazy API key, configured through the CLI:

dlazy auth set YOUR_API_KEY

The CLI saves the key in your user config directory (~/.dlazy/config.json on macOS/Linux, %USERPROFILE%\.dlazy\config.json on Windows), with file permissions restricted to your OS user account. You can also supply the key per-invocation via the DLAZY_API_KEY environment variable.

Getting Your API Key

1. Sign in or create an account at dlazy.com
2. Go to dlazy.com/dashboard/organization/api-key
3. Copy the key shown in the API Key section

Each key is scoped to your dLazy organization and can be rotated or revoked at any time from the same dashboard.

About & Provenance

• CLI source code: github.com/dlazyai/cli
• Maintainer: dlazyai
• npm package: @dlazy/cli (pinned to 1.0.6 in this skill's install spec)
• Homepage: dlazy.com

You can install on demand without persisting a global binary by running:

npx @dlazy/cli@1.0.6 <command>

Or, if you prefer a global install, the skill's metadata.clawdbot.install field declares the exact pinned version (npm install -g @dlazy/cli@1.0.6). Review the GitHub source before installing.

How It Works

This skill is a thin client over the dLazy hosted API. When you invoke it:

• Prompts and parameters you provide are sent to the dLazy API endpoint (api.dlazy.com) for inference.
• Any local file paths you pass to image / video / audio fields are uploaded to dLazy's media storage (oss.dlazy.com) so the model can read them — the same flow as any cloud-based generation API.
• Generated output URLs returned by the API are hosted on oss.dlazy.com.

This is the standard SaaS pattern; the skill itself does not access network or filesystem resources beyond what the dLazy CLI already handles. See dlazy.com for the full service terms.

Usage

CRITICAL INSTRUCTION FOR AGENT: Run the dlazy mj.imagine command to get results.

dlazy mj.imagine -h

Options:
  --prompt <prompt>                    Prompt
  --aspect_ratio <aspect_ratio>        Aspect Ratio [default: auto] (choices: "auto", "1:1", "4:3", "3:4", "16:9", "9:16", "3:2", "2:3", "21:9")
  --botType <botType>                  Bot Type [default: MID_JOURNEY] (choices: "MID_JOURNEY", "NIJI_JOURNEY")
  --output <output>                    Output [default: grid] (choices: "grid", "U1", "U2", "U3", "U4")
  --input <spec>                       JSON payload: inline string, @file, or - (stdin)
  --dry-run                            Print payload + cost estimate without calling API
  --no-wait                            Return generateId immediately for async tasks
  --timeout <seconds>                  Max seconds to wait for async completion (default: "1800")
  -h, --help                           display help for command

Output Format

{
  "ok": true,
  "kind": "urls",
  "data": {
    "urls": [
      "https://oss.dlazy.com/result.mp4"
    ]
  }
}

Command Examples

# basic call:
dlazy mj.imagine --prompt 'prompt text' --image '/path/to/image.png'

# complex call:
dlazy mj.imagine --prompt 'prompt text' --image 'https://oss.dlazy.com/image.png'

Error Handling

Code	Error Type	Example Message
401	Unauthorized (No API Key)	ok: false, code: "unauthorized", message: "API key is missing or invalid"
501	Missing required parameter	error: required option '--prompt <prompt>' not specified
502	Local file read error	Error: Image file/Video file not found: C:\path\to\your\file
503	API request failed (no balance)	ok: false, code: "insufficient_balance"
503	API request failed (server error)	HTTP status code error (500 server crash)
504	Asynchronous task execution failed	=== Generation Failed === / {Specific error reason returned by backend, for example "Prompt violates safety policy"}

AGENT CRITICAL INSTRUCTION:

1. If the execution result returns code: "insufficient_balance", you MUST explicitly inform the user that their credits are insufficient and guide them to recharge: https://dlazy.com/dashboard/organization/settings?tab=credits
2. If the execution result returns code: "unauthorized" or indicates missing API key, you MUST inform the user to get their API key from https://dlazy.com/dashboard/organization/api-key and save it using dlazy auth set <key> and resume the task.

Tips

Visit https://dlazy.com for more information.