Security audit
Security checks for vulnerabilities and agentic risk
The skill’s login, saved credentials, and media uploads are clearly disclosed and support its video-generation purpose.
Install if you trust dLazy to process your prompts and selected media and accept generation charges. Login saves an API key locally; use the documented environment-variable option if preferred. Preview requests with --dry-run and revoke the key when no longer needed.
The supplied code performs login rather than the declared text-to-video or image-to-video functionality. Authentication could support video generation, but this chunk provides no evidence of that connection or implements the advertised capability.
Authentication can be a supporting implementation detail, but the supplied chunk consists solely of a login command and shows no connection to Kling or a video-generation workflow. Its demonstrated purpose therefore materially differs from the declared purpose. There is no evidence of credential theft or other additional behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.