Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently supports hosted video generation and clearly discloses its login, file uploads, and saved project sessions.
Use documents you are comfortable sending to dLazy, check generation costs, and remember that login saves an organization API key locally. Prefer device-code login and revoke the key when access is no longer needed.
The supplied code only lists organization projects; it performs none of the declared video-generation workflow. No context establishes project enumeration as a supporting implementation detail, so the observed behavior accesses organizational resources outside the stated purpose.
The supplied code only lists organizational projects; it contains no video-generation behavior or demonstrated connection to that workflow. As provided, its primary behavior is project discovery rather than the declared explainer-video functionality.
The supplied code performs only a login operation rather than the described explainer-video workflow. Authentication could support a video service, but the supplied material does not establish that relationship. The command alone does not demonstrate credential theft or other malicious behavior.
The supplied code performs only a login operation, which materially differs from the declared purpose. Authentication could support a video service, but the chunk provides no evidence connecting this command to such a workflow. The command alone does not establish credential theft or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.