Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently uses dLazy’s hosted video service and clearly discloses authentication, project discovery, file uploads, and saved credentials.
Use scripts and reference files you are comfortable uploading to dLazy, select the intended project, and account for generation credits. The CLI stores an organization API key locally unless you supply it through the environment; revoke it when no longer needed.
The supplied chunk only enumerates organization projects. It contains no script processing or video-generation steps, and no context establishes project enumeration as a supporting step in the declared workflow.
The supplied chunk performs project discovery rather than script-to-video processing. Nothing in the chunk connects organization-wide project enumeration to the declared workflow, so it exposes an undeclared resource-access capability rather than a demonstrated supporting implementation detail.
Authentication could support a video-generation workflow, but the supplied chunk contains only credential setup and no demonstrated connection to scene breakdown, shot generation, video assembly, or validation. Its actual purpose therefore differs materially from the declared purpose. The chunk does not establish credential theft or other malicious behavior.
The supplied code only invokes a login command and does not implement the declared video-production workflow. Authentication could be a supporting prerequisite, but the supplied content provides no connection between this login and that workflow. No credential theft, data transfer, or other behavior beyond invoking login can be established from this command alone.
Authentication could support a larger video-generation workflow, but the supplied chunk contains only a login command and establishes no connection to that workflow. As supplied, its primary behavior is account login, materially different from the declared purpose.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.