Dlazy Video Generate

Video generation skill. Automatically selects the best dlazy CLI video model based on the prompt.

Security Scan

The skill's declared purpose (wrapping a dlazy CLI for video generation) is plausible, but there are inconsistencies and user-secret handling instructions that increase risk and deserve review before installing or using.

Purpose & Capability

Requesting npm/npx fits a CLI-based skill that installs a JS CLI (dlazy). However, the registry metadata claims 'No install spec' while the SKILL.md contains metadata with an explicit install command (npm install -g @dlazy/cli@1.0.5) — an inconsistency between declared registry fields and the runtime instructions.

Instruction Scope

Runtime instructions ask the agent to pick a dlazy model, run dlazy <model> -h and then execute the chosen dlazy command (expected). Crucially, the instructions also tell the agent to ask the user for their dlazy API key in chat and, once provided, to run 'dlazy auth set <key>' to save it — this encourages users to paste secrets into chat and instructs the agent to store them locally. That expands scope beyond pure generation and risks secret exposure.

Install Mechanism

There is no formal install spec in the registry entry, but the SKILL.md metadata contains 'npm install -g @dlazy/cli@1.0.5'. Installing an unreviewed global npm package from an external namespace is a moderate risk: the package is traceable on the registry but not vetted here. The discrepancy between 'no install spec' and an in-document install instruction is a red flag.

Credentials

The skill declares no required env vars or primary credential, yet the instructions expect an API key for dlazy and instruct the agent to request it from the user and save it via the CLI. The skill does not declare how credentials will be provided or protected (no primaryEnv or secret-management guidance), making the credential handling disproportionate and ambiguous.

Persistence & Privilege

always:false (good), but the skill explicitly directs saving the user's API key to the dlazy CLI configuration ('dlazy auth set <key>'). That creates persistent credentials on disk which the agent could reuse later. Combined with autonomous invocation being permitted by default, this increases the blast radius if the key is mishandled or if the agent is compromised.

What to consider before installing

Do not paste API keys or other secrets into chat. Before installing or using this skill: 1) Confirm whether the platform provides a secure secret input (preferred) and avoid sending keys in conversation. 2) Verify the npm package @dlazy/cli@1.0.5 on the npm registry and the vendor's website (https://dlazy.com) before installing; prefer installing packages manually under your control. 3) Ask the skill author (or registry owner) to declare an explicit install spec and how credentials should be provided (primaryEnv or platform secret), and to remove any instruction that tells the agent to request secrets in chat. 4) If you must proceed, limit scope: run installs in an isolated environment, review the CLI’s behavior, and do not reuse high-privilege API keys.

Video generation skill. Automatically selects the best dlazy CLI video model based on the prompt.

Trigger Keywords

• generate video
• text to video
• animate image

Usage

This skill handles all video generation requests by selecting the best dlazy video model.

Available Video Models

• dlazy veo-3.1, dlazy veo-3.1-fast: High-quality cinematic sequences.
• dlazy sora-2, dlazy sora-2-pro: Narrative clips.
• dlazy kling-v3, dlazy kling-v3-omni: General short clips.
• dlazy seedance-1.5-pro: Narrative shorts with transitions.
• dlazy wan2.6-r2v, dlazy wan2.6-r2v-flash: General/fast video production.
• dlazy viduq2-i2v, dlazy jimeng-i2v-first, dlazy jimeng-i2v-first-tail, dlazy jimeng-dream-actor, dlazy jimeng-omnihuman-1.5: Image-to-video, digital human, action transfer.

CRITICAL INSTRUCTION FOR AGENT:

1. Select the most appropriate video model.
2. Run `dlazy <model_name> -h` to check parameters.
3. Execute the command.

Error Handling

Code	Error Type	Example Message
401	Unauthorized (No API Key)	ok: false, code: "unauthorized", message: "API key is missing or invalid"
501	Missing required parameter	error: required option '--prompt <prompt>' not specified
502	Local file read error	Error: Image file/Video file not found: C:\path\to\your\file
503	API request failed (no balance)	ok: false, code: "insufficient_balance"
503	API request failed (server error)	HTTP status code error (500 server crash)
504	Asynchronous task execution failed	=== Generation Failed === / {Specific error reason returned by backend, for example "Prompt violates safety policy"}

AGENT CRITICAL INSTRUCTION:

1. If the execution result returns code: "insufficient_balance", you MUST explicitly inform the user that their credits are insufficient and guide them to recharge: https://dlazy.com/dashboard/organization/settings?tab=credits
2. If the execution result returns code: "unauthorized" or indicates missing API key, you MUST inform the user to get their API key from https://dlazy.com/dashboard/organization/api-key and send it to you. Once they provide it, save it using dlazy auth set <key> and resume the task.

Tips

Visit https://dlazy.com for more information.