Security audit
Security checks for vulnerabilities and agentic risk
The skill’s image-generation commands, cloud uploads, and saved login are disclosed and fit its stated purpose.
Review the third-party CLI before installing. Prompts and selected images are uploaded to dLazy, generation can consume paid credits, and login saves a revocable API key locally. Invoke it for explicit image-generation requests.
The supplied chunk only invokes a login command; it contains no image-generation request, image input handling, or Seedream invocation. Authentication could support image generation, but this chunk provides no evidence connecting the login to the declared service or implementing the advertised functionality. The command alone does not establish credential theft or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
“豆包” can refer to the general-purpose Doubao assistant or to food, rather than specifically to Seedream image generation. Listing it as an independent trigger without requiring image-generation intent or providing exclusions could activate this skill for unrelated requests.
No suspicious patterns detected.