Security audit
Security checks for vulnerabilities and agentic risk
The skill’s video creation workflow is coherent and openly discloses its login, file uploads, and saved project sessions.
Use files and briefs you are comfortable sharing with dLazy, and expect generation to consume service credits. Login saves an organization API key locally unless you use the environment-variable alternative. The external CLI and hosted service remain dependencies beyond the bundled skill documents.
The supplied code only lists organization projects; it does not create or configure a marketing video. Although project discovery could support a broader workflow, no such connection is present in this chunk, so its demonstrated purpose differs materially from the declared purpose.
The supplied code only lists organization projects; it contains no video-creation behavior or demonstrated connection to a video-production workflow. As supplied, its resource access and primary behavior differ materially from the declared purpose.
Authentication could support a video-generation workflow, but the supplied chunk consists solely of a login command and provides no connection to video creation. Its observable purpose therefore differs materially from the description. The command alone does not establish credential theft or other malicious activity.
The supplied code performs login rather than the advertised video creation. Authentication could be a supporting implementation detail, but this chunk provides no evidence that dlazy login supports a video-generation workflow. This assessment is limited to the supplied chunk and does not imply credential theft or other unobserved behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.