Security audit
Security checks for vulnerabilities and agentic risk
The skill’s speech-generation commands fit its clearly disclosed cloud processing, login, and installation requirements.
Use this skill if you are comfortable sending your text to dLazy and paying its generation charges. Review the pinned CLI before installation, avoid submitting confidential material without checking the service’s privacy terms, and protect or revoke any saved API key.
The supplied chunk contains only a login command. It does not process text, invoke a TTS model, or generate audio. Authentication could support a TTS implementation, but this chunk provides no evidence connecting dlazy login to that purpose.
The supplied code performs a login operation rather than speech synthesis. Authentication could support a TTS workflow, but the chunk provides no evidence that dlazy login authenticates to Doubao or otherwise supports the declared purpose. No credential theft or other downstream behavior can be established from this command alone.
The supplied chunk contains no identifiable text-to-speech operation, Doubao integration, text input handling, or audio output. Instead, it delegates to an unspecified CLI command. CLI execution could support TTS, but the provided code does not establish that connection. The package's internal behavior cannot be determined from this snippet.
The supplied chunk contains no identifiable speech-synthesis operation, text input handling, or Doubao integration. It instead provides a generic external CLI invocation. An external CLI could support the declared purpose, but neither its command nor its implementation is supplied, so that connection is not established. The package's internal behavior and any additional side effects cannot be determined from this chunk.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.