Security audit
Security checks for vulnerabilities and agentic risk
This audio-generation skill uses a disclosed cloud service, with ordinary installation, upload, cost, and API-key considerations.
Prompts and selected media are sent to dLazy, and generation can consume paid credits. Review its privacy terms, upload only intended files, and protect the saved API key. The pinned CLI is an external dependency that executes locally.
Only the qwen-tts step directly matches the declared audio/TTS purpose. The code also independently generates images, animates an image into video, and batch-upscales images; these are substantial undeclared capabilities rather than supporting audio implementation details. The supplied chunk uses fixed models and prompts and does not demonstrate automatic audio-model selection.
Although one pipeline includes TTS, the chunk also demonstrates independent visual-generation and image-processing workflows outside the declared audio/TTS purpose. These are substantive additional capabilities, not merely supporting implementation details. The claimed automatic selection of an audio/TTS model is not implemented in the supplied chunk.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
The instruction “只给一个英文描述词检索” explicitly requires using a single English descriptor for voice searches. The explanation justifies limiting keyword count, but does not justify requiring English or offer user opt-in.
The instruction to search with “ONE short English descriptor” imposes a specific language on voice-search queries without offering a choice. Although the text explains why queries should be short, it does not explain why they must be in English.
No suspicious patterns detected.