Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently supports cloud-based image generation and clearly discloses authentication, local key storage, and uploads of selected files.
Use only prompts and images you are comfortable sending to dLazy, consider generation charges, and protect the locally stored API key. Review the pinned CLI before installation; the supplied static scan reported no findings, but that does not establish dependency safety.
The sole executable action is a login command, materially different from the declared image-generation and editing purpose. Authentication could be a supporting implementation detail if tied to the image service, but the supplied chunk establishes no such relationship. The command alone does not establish credential theft or other malicious behavior.
The supplied code only invokes a login command and contains no image-generation or editing operation. Authentication can be a supporting implementation detail, but nothing supplied connects this login workflow to Nano Banana 2.0 or the declared image functionality. The command's internal handling of credentials or network access cannot be determined from this snippet.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.