Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently documents cloud video generation, including its account requirements, local credential storage, and uploads of selected media.
Use media you are comfortable uploading to dLazy and consider generation costs. Login saves an API key locally; environment-variable authentication is also documented. The skill documents were fully reviewed, but the external CLI distribution and service privacy practices were not fully audited.
The only supplied command performs login rather than any declared video-generation operation. Authentication could be a supporting implementation detail, but this chunk provides no evidence that dlazy login supports Tongyi Wanxiang. No credential theft or other hidden behavior can be inferred from the command alone.
The supplied chunk contains only a login command and implements none of the described video-generation modes. Authentication could support a larger video workflow, but no such workflow or connection to Tongyi Wanxiang is present in the supplied code. There is no evidence of credential exfiltration or other malicious behavior.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 错误处理
| Code | 错误类型 | 示例信息 |
| ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` |
| 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |
No suspicious patterns detected.