Security audit
Security checks for vulnerabilities and agentic risk
This image-search skill clearly discloses its dLazy service integration, and its bundled files show no harmful behavior.
Expect a dLazy account, local key storage, and possible service charges. Share only intended search inputs or files, and keep API keys out of chat. The external CLI/API were not fully audited. Check command help because the example and listed search option differ.
The supplied command has a materially different apparent purpose from the declared image-search functionality. Nothing in the code connects this login operation to Pixabay or establishes it as a supporting implementation detail. The CLI's underlying authentication behavior cannot be determined from this chunk alone.
The supplied code contains no image search, Pixabay API request, or image metadata handling. Its only visible action is a login command for a different tool, with no demonstrated connection to the declared purpose. The command's internal authentication behavior is not shown.
The supplied chunk only sets dlazy authentication. It contains no Pixabay API request, keyword search, or image-result handling, and establishes no connection between dlazy authentication and the declared functionality. There is no evidence in this chunk of credential exfiltration or other additional behavior.
The supplied code performs only an authentication-setting operation. It contains no Pixabay request, keyword search, or image-result handling. Authentication could support an image-search implementation, but this chunk provides no evidence linking the dlazy command to that purpose.
The supplied chunk exposes a generic package-execution command rather than a Pixabay image-search operation. Nothing shown connects that CLI to keyword searches, image URLs, or metadata retrieval. The package's implementation is unavailable, so its downstream behavior cannot be established; the mismatch assessment is limited to the supplied command.
The supplied chunk delegates execution to @dlazy/cli rather than showing a Pixabay query or image-result processing. Nothing establishes that this CLI invocation implements the declared image-search purpose. The package implementation and command are unavailable, so its downstream behavior cannot be determined from this chunk.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |