Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently supports cloud-based video creation and clearly discloses authentication, project access, file uploads, and saved sessions.
Prompts and selected attachments go to dLazy, and video generation may consume paid credits. Choose the intended organization project, upload only appropriate media, and protect or revoke the saved API key as needed. This review does not establish the security of the external CLI or hosted service.
The supplied code only lists organization projects; it does not perform any declared video-generation or assembly steps. No connection is shown between this project enumeration and the stated video-making purpose, making the observed behavior materially different from the description.
The supplied code only enumerates organization projects; it does not perform any declared video-production step. No connection is shown between this project listing and the video-making workflow, so the observed behavior materially differs from the declared purpose.
Authentication could support a video-making workflow, but the supplied chunk contains only credential setup and no implementation or invocation of the advertised video-making capabilities. Its demonstrated purpose therefore materially differs from the description. There is no evidence here of credential theft or video output.
Login could support a larger video workflow, but it is the entirety of the supplied code and has no demonstrated connection to the declared production capabilities. As supplied, the code does not substantiate the described purpose. There is no evidence here of credential theft or other malicious behavior.
No storyboard creation, media generation, voiceover, subtitle rendering, or video assembly is present. Login could support a larger video-making workflow, but the supplied code contains only that operation and establishes no connection to the advertised functionality. The command alone does not demonstrate credential theft or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.