Security audit
Security checks for vulnerabilities and agentic risk
The skill provides a coherent cloud image-generation workflow with clearly disclosed uploads, authentication, and local API-key storage.
Use prompts and images you are comfortable sending to dLazy, review generation costs, and protect or revoke your API key as needed. The external CLI and its claimed key-storage protections were not audited in this review.
The supplied code performs login rather than text-to-image or image-to-image generation. Authentication could be a supporting implementation detail, but this chunk provides no evidence that dlazy login supports the declared Seedream workflow. The assessment is limited to the supplied chunk; it does not establish credential theft or other malicious behavior.
Authentication can be a supporting implementation detail, but the supplied content consists solely of a login command and shows no connection to Seedream or image generation. As supplied, its observable purpose differs from the declared purpose. The command alone does not establish credential theft or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.