Security audit
Security checks for vulnerabilities and agentic risk
This image-generation skill clearly discloses its cloud service, login requirements, local credential storage, and installation method.
Install only if you trust the dLazy CLI and service. Prompts and any supplied media leave your device, generation may cost credits, and login saves an API key locally. Use device login or an environment variable to avoid placing a key in command history.
The supplied chunk performs a login operation rather than generating images. Authentication could support an image-generation service, but nothing in the supplied code establishes that connection. Its visible behavior therefore materially differs from the declared purpose.
The supplied code performs authentication setup instead of the declared image-generation task. Authentication could support an image-generation workflow, but no such workflow or connection is shown here. The placeholder does not establish access to a real credential or credential exfiltration.
The supplied code only invokes a login command; it contains no image-generation operation or parameters. Authentication could support an image-generation workflow, but no such connection is established in this chunk. The visible behavior therefore does not substantiate the declared purpose. The command alone does not establish credential theft or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.