Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed wrapper for a hosted dLazy image-generation CLI, with a documentation mismatch about SVG versus PNG output but no artifact-backed malicious behavior.
Before installing, understand that prompts and any file paths you intentionally pass may be sent to dLazy's hosted service, and the CLI can store a dLazy API key locally. Also verify whether the service currently returns true SVG/vector assets or PNG images, because the documentation is inconsistent.
The manifest and repeated description state this skill is a text-to-vector model that outputs SVG results, suitable for scalable vector assets. However, the documented output example shows a hosted result.png with mimeType: "image/png", which indicates raster output rather than SVG/vector output.
Referenced artifact was not completely inspected
[English](./SKILL.md) · [中文](./SKILL-cn.md)
This skill description and operational instructions are written entirely in Chinese, including imperative agent directions such as how to execute the command and what to tell the user on errors. The file links to an English version, but this file itself does not state any user opt-in or language selection behavior, so it imposes a specific language/locale in natural-language instructions.
The file's documentation presents this skill as producing SVG/vector results, but the explicit output-format section documents an image URL ending in .png and MIME type image/png. This is an active contradiction in the skill's own documentation, not merely an omitted detail.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
The skill manifest and top-level description repeatedly state that this is a text-to-vector model producing SVG results. However, the documented output example shows type: "image", a .png URL, and mimeType: "image/png", which directly contradicts the stated SVG/vector output behavior rather than merely omitting details.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## Error Handling
| Code | Error Type | Example Message |
| ---- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | Unauthorized (No API Key) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | Missing required parameter | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.