Security audit
Security checks for vulnerabilities and agentic risk
The skill clearly explains how login, project access, and uploads support its video-making purpose.
Installation runs a third-party CLI. Send only URLs, prompts, and attachments you are comfortable sharing with dLazy, select the intended organization project, and consider service credit costs. Login saves an API key locally; the skill also documents an environment-variable option and key revocation.
The supplied code only lists organization projects; it does not process a URL or perform any video-creation steps. No connection is shown between this project enumeration and supporting the declared workflow, so the chunk's actual purpose materially differs from its description.
The supplied chunk only lists organization projects. It does not process a URL or perform any declared video-creation step, and no context establishes project enumeration as a supporting implementation detail.
The supplied code contains no URL handling or video-production operations; its only visible action is a login command. Authentication could support a larger video workflow, but no such connection or workflow is present in this chunk. The exact authentication behavior depends on the unavailable dlazy implementation.
Login could be a supporting prerequisite for a video service, but the supplied code consists entirely of that operation and does not implement or invoke the advertised conversion functionality. This assessment is limited to the supplied chunk; it does not establish credential theft or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.