Security audit
Security checks for vulnerabilities and agentic risk
ClawScan’s verdict is benign with medium confidence: the main reported concern is a CLI login operation that Skillspector says is not clearly connected to the skill’s advertised image work.
The verdict is benign, but confidence is medium and the scan evidence is incomplete: some referenced local paths were not available for resolution. Before installing, consider whether you are comfortable with the reported CLI login step and the unresolved references.
The supplied code performs authentication rather than the advertised image-generation and editing work. Although login could support a broader workflow, the supplied content establishes no connection between dlazy authentication and the declared image service. The command alone does not establish credential theft or other malicious behavior.
The only supplied command initiates login, which is not disclosed in the description. Authentication could support a larger image workflow, but this chunk provides no evidence connecting dlazy login to that workflow. Its observable purpose is authentication rather than the declared image functionality; the command alone does not establish credential theft or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |