Security audit
Security checks for vulnerabilities and agentic risk
The skill provides a coherent cloud background-removal workflow and clearly discloses image uploads, authentication, and local API-key storage.
Install only if you trust dLazy and its CLI package. Selected images leave your device, processing can consume service credits, and login stores an API key locally. Consider image sensitivity and keep credentials out of shared logs.
The supplied chunk performs a login operation rather than image matting. Authentication could support a larger service workflow, but no such connection is established here. Based on the supplied code, its behavior materially differs from the declared purpose.
Authentication can be a supporting implementation detail, but the supplied chunk contains only an authentication setup command and no image-processing operation. Its demonstrated behavior therefore does not substantiate the declared image-matting purpose. There is no evidence in this chunk of credential exfiltration or other additional behavior.
The supplied code only invokes a login command and does not implement the declared image-matting functionality. Authentication could support a larger workflow, but the supplied chunk provides no connection between this login operation and the described image-processing service.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.