Security audit
Security checks for vulnerabilities and agentic risk
The skill’s disclosed authentication, media uploads, and video-generation workflow fit its stated purpose.
Install only if you accept dLazy receiving your supplied prompts and media and charging generation credits. Protect the saved API key. Consult command help because the examples use inconsistent image flags and output types.
Authentication could support a video-generation workflow, but the supplied chunk contains only a login command and establishes no connection to Jimeng or video generation. Its demonstrated primary behavior therefore differs from the declared purpose. The command alone does not establish credential theft or other malicious activity.
The supplied code contains no image handling, Jimeng model invocation, or video generation. Authentication can be a supporting implementation detail, but this chunk provides no evidence that the dlazy login operation supports the declared workflow. Its only observable operation is login rather than video generation.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.