Security audit
Security checks for vulnerabilities and agentic risk
The skill’s hosted document-to-video workflow is coherent and clearly discloses file uploads, account authentication, and saved sessions.
Only attach documents you are comfortable sending to dLazy. Check its retention terms and credit costs, protect the saved organization API key, and revoke it when no longer needed.
The supplied command queries organization project metadata rather than processing a PDF or producing a video. No connection to the declared workflow is shown, so this is an undeclared capability and a materially different purpose.
The supplied code only lists organization projects. It contains no PDF processing or video-generation steps, and no context establishes project enumeration as a supporting implementation detail of the declared workflow.
The supplied code performs only a login operation, which materially differs from the declared conversion workflow. Authentication could support a larger implementation, but the provided chunk establishes no such relationship. There is no evidence here of credential theft or other additional behavior.
The supplied code contains only a login command and performs none of the declared PDF-to-video steps. No context establishes this login as a supporting dependency of the advertised workflow. The command alone does not establish what credentials, services, or resources it accesses.
Authentication could support a video-generation workflow, but the supplied chunk contains no PDF processing or video-generation operations and does not establish such a connection. Its sole demonstrated behavior is credential configuration, which does not substantiate the declared primary purpose. No credential exfiltration or other malicious behavior is shown.
The supplied chunk performs only authentication configuration; it contains none of the declared PDF-to-video workflow. Authentication could support such a workflow, but the provided code does not establish that connection. There is no evidence here of PDF access, video generation, or credential exfiltration.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.