Security audit
Security checks for vulnerabilities and agentic risk
The skill clearly discloses its dLazy login and cloud data handling, with no harmful behavior found in the bundled instructions.
Use this skill if you accept dLazy as the intermediary and its potential credit charges. Login saves an API key locally; the environment-variable option avoids that saved configuration. Only supply files you intend to upload, and confirm --query usage through command help. Both bundled files were reviewed, but the external CLI package and hosted backend were not fully audited.
The supplied command performs authentication configuration, not video search, and contains no Pixabay API request or video metadata retrieval. Authentication can be a supporting implementation detail, but the chunk provides no evidence connecting dlazy authentication to the declared Pixabay functionality.
The supplied code performs a login command rather than querying Pixabay or returning video results. Nothing in the chunk establishes this login as a supporting step for the declared video-search functionality. The command's internal implementation and any resulting resource access are not visible.
The supplied command performs a login operation rather than querying Pixabay. Nothing in the chunk connects this authentication step to the declared video-search functionality. The command's downstream effects cannot be determined without the CLI implementation.
The supplied code only sets an authentication credential; it does not query the Pixabay video API, process keywords, or return video URLs and metadata. Authentication could support a search tool, but this chunk provides no evidence linking the dlazy command to the declared functionality.
The supplied content specifies launching an external CLI but does not identify a video-search command, Pixabay integration, or URL and metadata output. Using a CLI could be a supporting implementation detail, but the provided chunk establishes no connection to the declared purpose. The package's internal behavior is unavailable, so no additional capabilities or malicious behavior are inferred.
The supplied chunk does not implement or demonstrate the declared video-search behavior; it delegates to an unspecified external CLI command. The package's underlying capabilities cannot be determined from this snippet, so this finding does not imply malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |