Security audit
Security checks for vulnerabilities and agentic risk
The verdict is benign with medium confidence: the scanners found no AIG issues, but Skillspector reported a mismatch between the advertised image-generation purpose and the authentication and unspecified CLI behavior it reviewed.
The verdict is benign, but confidence is medium and the scan was partial. Before installing, review the skill’s authentication and CLI instructions, confirm that the external CLI is the one you intend to use, and inspect the whitespace-flagged section; the scanners did not verify the unavailable package details.
The supplied code only initiates login, rather than providing the advertised image-generation functionality. Authentication could support a larger implementation, but the chunk provides no evidence connecting this login to Seedream or the declared purpose.
Authentication could support an image-generation workflow, but the supplied chunk consists entirely of authentication setup and contains no connection to Seedream 5.0 or the advertised visual capabilities. Its demonstrated primary purpose therefore differs from the description. The command alone does not establish credential theft or data exfiltration.
Authentication can be a supporting implementation detail, but the supplied chunk consists entirely of a login command, with no demonstrated connection to Seedream or the advertised capabilities. On the supplied evidence, its primary behavior differs materially from the declared purpose. The command alone does not establish credential theft or other malicious activity.
The supplied chunk does not establish the declared image-generation behavior: it names neither Seedream nor an image-generation command and instead exposes an unspecified external CLI invocation. A CLI could support the declared purpose, but the supplied code does not demonstrate that connection. The package's internal behavior is unavailable, so no additional capabilities or malicious behavior are inferred.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |