Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently uses dLazy to turn documents into videos and discloses its uploads, authentication, and saved sessions.
Use this skill for an explicit video-generation request, rather than ordinary report analysis. Prompts and selected attachments go to dLazy, so check that those documents may be shared with the service. Consider credit costs, saved project context, and the locally stored API key before installing.
The supplied code only lists organization projects. It does not process presentations or perform any declared video-production step, and no connection is shown that would make project enumeration a supporting implementation detail.
The supplied code queries organization projects rather than processing a presentation or producing a video. No connection is shown that would make this project enumeration a supporting implementation detail of the declared workflow.
The supplied code performs only a login operation, which does not substantiate the declared presentation-to-video workflow. Authentication could be a supporting implementation detail in a larger workflow, but no such relationship is established here. The command alone does not establish what credentials, network endpoints, or other resources it accesses.
The only supplied command performs authentication rather than presentation-to-video conversion. No connection is shown between this login operation and the declared workflow, so it cannot be established as a supporting implementation detail. The chunk does not establish credential theft, data exfiltration, or successful authentication.
The supplied chunk only configures CLI authentication and contains no deck parsing or video-production behavior. Authentication could support a larger workflow, but the supplied code establishes no connection to the declared purpose. There is no evidence of credential theft or other additional behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
The trigger “报告解读” describes ordinary report interpretation without requiring a request for video creation, making unintended skill selection possible. This matters because the skill instructs the agent to send prompts and attached files to an external SaaS provider; incorrect routing could disclose report content outside the user's intended workflow, although the text does not establish that triggering alone automatically uploads files.
No suspicious patterns detected.