Security audit
Security checks for vulnerabilities and agentic risk
The skill clearly discloses the login, image uploads, and saved service key needed for its hosted image-conversion workflow.
Use images you are comfortable uploading to dLazy and consider service credit costs. Protect the saved organization API key or use the environment-variable option. Check current command help and confirm the returned file is SVG because the examples contain inconsistencies.
The only supplied command performs login rather than image vectorization. No connection is shown between this authentication step and an image-conversion workflow, so the observed behavior materially differs from the declared purpose. The command alone does not establish credential theft or other malicious activity.
The supplied chunk only configures CLI authentication; it does not process images, generate SVGs, or return a URL. Authentication could support a larger conversion workflow, but no such workflow is shown, so the supplied behavior does not substantiate the declared purpose.
The supplied code performs a login operation rather than raster-to-SVG conversion. Nothing in the chunk connects this login to a vectorization service or establishes it as a supporting implementation detail. The command's authentication mechanism and effects cannot be determined from this chunk alone.
Authentication could support a conversion workflow, but the supplied chunk contains only an authentication setup command and no connection to the declared image-vectorization functionality. As supplied, its sole behavior materially differs from the declared purpose. There is no evidence of credential exfiltration or other additional behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.