Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently supports image generation through dLazy and clearly discloses authentication, local key storage, and media uploads.
Use this only with prompts and images you are comfortable sending to dLazy, and consider account charges. Protect the stored API key and review the pinned third-party CLI before installation.
The supplied chunk only invokes a login command; it contains no image-generation or editing operation and establishes no connection between this authentication flow and GPT Image 2. Authentication could be a supporting implementation detail, but the supplied code does not demonstrate that relationship. There is no evidence here of credential theft or other additional behavior.
The supplied code performs only a login operation and does not implement the declared image capabilities. Authentication could be a supporting step, but the chunk provides no connection between this login and GPT Image 2. The command alone does not establish credential theft or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.