Security audit
Security checks for vulnerabilities and agentic risk
The skill openly uses dLazy for hosted model requests, with ordinary authentication and installation steps, but sends prompts externally and can consume paid credits.
Use this integration when you deliberately want dLazy processing and accept its charges. Limit generic chat triggers if your host automatically selects skills, and send only intended prompts or files. Both bundled documents were inspected; the external CLI package and its credential-storage implementation remain unverified. The supplied static scan reported no findings, while the advisory login-mismatch and hidden-whitespace concerns were not supported by the full artifacts.
The supplied code performs a login operation rather than the declared text-generation, question-answering, or reasoning tasks. Authentication could be a supporting setup step, but the provided chunk does not establish that relationship. No further behavior, such as credential collection or transmission, can be determined from this command alone.
The supplied code only invokes a login command; it contains no model invocation, text generation, question answering, or reasoning functionality. Authentication could support a model integration, but the supplied chunk does not establish that relationship. The command's internal behavior and any resources it accesses cannot be determined from this snippet.
The supplied chunk is a generic external CLI invocation rather than an identifiable Grok 4.2 integration. It provides no model selection, inference request, or command establishing the declared functionality. Although a CLI could be a supporting implementation detail, that relationship is not established here. The package's downstream behavior cannot be determined from this chunk, so no additional capabilities such as data exfiltration are inferred.
Generic triggers such as text generation, question answering, and chat can select this skill without an explicit request to use an external provider. If the host uses these triggers for automatic invocation, the instruction to run the CLI can cause unintended transmission of prompts to dLazy and consumption of paid credits; the API disclosure does not itself establish user authorization.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------- | ---------------------------------------------------------------------------------------------- |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
Triggers such as 'generate text', 'qa', and 'chat' overlap with ordinary assistant requests that do not explicitly authorize dLazy usage. If these triggers drive automatic invocation, the mandatory CLI instruction can route user content to an external service and incur charges without a deliberate provider choice.
No suspicious patterns detected.