Security audit
Security checks for vulnerabilities and agentic risk
The skill’s authentication, media uploads, and video commands are disclosed and fit its stated purpose.
Review the external CLI before installation. Use media you are comfortable uploading to dLazy, check generation costs with --dry-run, and protect the saved API key or use the documented environment-variable option.
Authentication could support a larger implementation, but the supplied chunk shows only a login command and no connection to the declared functionality. As provided, its behavior does not substantiate the stated video-replication purpose. The command alone does not establish credential theft or other malicious activity.
Authentication could support the declared workflow, but the supplied code contains only that setup command and none of the promised video-processing behavior. The assessment is limited to this chunk; it does not establish credential theft or other malicious behavior.
Authentication could support a larger implementation, but the supplied chunk contains only an authentication-setting command. It provides no video input handling, frame or audio extraction, video understanding, or replication-bundle generation. No credential exfiltration or other hidden behavior is evident.
The chunk contains only dlazy login. It shows no video input handling, frame or audio extraction, video understanding, or replication-bundle generation. Authentication could support a larger implementation, but no such implementation or connection to the declared purpose is present in the supplied code.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.