Security audit
Security checks for vulnerabilities and agentic risk
The skill’s login, media uploads, and local key storage are disclosed and fit its video-generation purpose.
Prompts and selected media leave your computer, generation can spend dLazy credits, and login saves an organization API key locally. Use media you are comfortable uploading, review the pinned CLI package, and use --dry-run to preview the request and estimated cost.
Authentication could support a video-generation service, but the supplied chunk shows only a login command and establishes no connection to Seedance or video generation. Its demonstrated purpose therefore materially differs from the description. The command alone does not establish credential theft or other malicious behavior.
The only visible action is a login command. Authentication could support a video-generation workflow, but the supplied code establishes no such connection and implements none of the advertised generation features. As supplied, its primary behavior differs materially from the description.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.