Security audit
Security checks for vulnerabilities and agentic risk
The skill clearly discloses login, image uploads, and paid generation, all consistent with its stated purpose.
Use images you are comfortable uploading to dLazy, review generation costs with --dry-run, and consider whether to persist your API key locally. Installation also requires trusting the external npm CLI.
The supplied chunk contains only a login command and shows no image analysis, prompt construction, or image-generation handoff. Authentication could support a larger workflow, but nothing supplied connects dlazy login to the declared tool. The command's underlying implementation and any credential handling are not visible.
The code contains no source-image analysis, prompt construction, or Seedream generation call. Authentication could support a larger implementation, but the supplied chunk establishes no such connection and implements only login. This assessment does not imply credential theft or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.