Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently documents cloud video generation, including authentication, media uploads, costs, and local credential storage.
Use media you are comfortable uploading to dLazy and check generation costs. Login saves a service key locally. Review the pinned CLI before installing; this inspection covers the skill instructions, not the full external package.
Authentication could support a larger video-generation workflow, but the supplied code shows only a login command, with no connection to Vidu Q2, image inputs, or video generation. As supplied, its behavior does not implement the declared purpose. The chunk does not establish how credentials are handled.
The supplied code performs login rather than the declared image-to-video conversion. Authentication could be a supporting prerequisite, but nothing in this chunk connects dlazy login to Vidu Q2 or implements the advertised functionality. The command alone does not establish credential theft or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.