Security audit
Security checks for vulnerabilities and agentic risk
ClawScan’s verdict is benign, with medium confidence: the available evidence reports no malicious behavior, but raises a mismatch between the advertised video features and observed CLI authentication commands, and the scan is incomplete.
The verdict is benign, but confidence is medium and the evidence is incomplete: Skillspector could not resolve several referenced items, and the external CLI package’s behavior was not verified. Before installing, consider whether you are comfortable setting up dLazy CLI authentication and relying on an unverified package; the scan does not establish that the advertised video features are implemented.
Authentication could support a video workflow, but the supplied chunk contains only a login command and no connection to Happy Horse or implementation of the declared video capabilities. Its sole observable operation therefore does not substantiate the declared purpose.
The supplied code performs authentication rather than the advertised video operations. Authentication could be a supporting implementation detail, but this chunk provides no evidence connecting dlazy login to Happy Horse or its sub-model routing. No credential theft or other hidden behavior can be inferred from this command alone.
Authentication could support a video workflow, but the supplied chunk contains only credential configuration and no connection to Happy Horse or its advertised operations. As supplied, its sole behavior materially differs from the declared purpose. There is no evidence of credential exfiltration or other hidden operations.
The description promises specific video capabilities and automatic sub-model routing, but the only supplied code delegates an unspecified command to an external package. Nothing in the chunk connects that invocation to Happy Horse or its advertised modes. The external package could potentially implement those features, but its behavior is not supplied, so that relationship cannot be verified. This finding does not imply that the package is malicious.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |