Security audit
Security checks for vulnerabilities and agentic risk
The skill’s speech-generation instructions, dLazy authentication, and cloud data transfers are clearly disclosed and fit its purpose.
Use text and files you are comfortable sending to dLazy, review its privacy terms and credit costs, and protect the saved organization API key. The pinned npx option avoids a global CLI installation. This assessment covers the skill instructions, not a full audit of the external CLI or hosted service.
The supplied code performs a login operation rather than generating audio. Authentication could support a TTS implementation, but nothing in this chunk establishes that relationship. The visible behavior therefore does not match the declared purpose.
The supplied code performs a login operation rather than audio generation. Although authentication can be a supporting implementation detail, this chunk provides no evidence that dlazy login supports the declared Gemini text-to-speech purpose. The command's underlying authentication behavior cannot be determined from this snippet.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.