Security audit
Security checks for vulnerabilities and agentic risk
ClawScan’s verdict is benign with medium confidence: the scanners reported no AIG findings, while Skillspector flagged a login command that does not demonstrate the described image-generation purpose and whitespace padding in a Chinese file.
The verdict is benign, but the scan was partial: it could not resolve several local references, including references to the CLI package and workflow details. Before installing, consider whether you are comfortable using the reported login flow and the pinned CLI package; the scan does not establish how that login supports image generation.
Authentication can be a supporting implementation detail, but the supplied chunk consists solely of a login command and provides no connection to Doubao or image generation. Its observable purpose therefore differs materially from the description. The command alone does not establish credential theft or other malicious behavior.
The supplied code only invokes a login command and does not implement the declared image-generation purpose. Authentication could support a larger workflow, but no connection to Doubao or image generation is established in this chunk. The command alone does not establish credential theft or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |