SearchOnlineAssets

这个技能用于调用在线公共素材库 (如 Pixabay) 搜索所需的高质量媒体资源，并能够将搜索结果信息和图片 URL 提供给当前工作流或对话环境使用。

Security Scan

The skill claims to 'search public asset libraries (e.g., Pixabay)' but its instructions and metadata actually require installing and using a private dLazy CLI/API (including an API key and uploading local files), which is a meaningful mismatch and a potential data/credential exposure risk.

Purpose & Capability

The skill description says it searches public asset libraries (Pixabay-like). The SKILL.md and metadata instead direct the agent to install/use @dlazy/cli, call api.dlazy.com, and run generation commands (e.g., dlazy seedream-4.5). That is not the same as searching public asset catalogs and suggests the skill's stated purpose does not align with what it actually requires and does.

Instruction Scope

Runtime instructions require executing terminal commands (dlazy CLI), uploading local media to oss.dlazy.com, and following an interactive step-by-step generation flow. They also forbid saving prompts to files and require synchronous single-command execution. These instructions go beyond a simple search API usage and include actions (CLI-driven uploads of local files) that could exfiltrate data.

Install Mechanism

The skill is instruction-only (no install spec at registry level) but metadata embeds an install command for an npm package (@dlazy/cli@1.0.6) and suggests using npx. Installing from the npm registry is a moderate risk (third-party code execution) but not as risky as arbitrary URL downloads. There is a version inconsistency: skill package references 1.0.6 in metadata while registry shows version 1.0.4 / SKILL version 1.0.0 — review the package/repo before installing.

Credentials

The skill's top-level requirements list no env vars, but the instructions explicitly require a DLAZY API key (and describe dlazy auth set and storing the key in ~/.dlazy/config.json). Requiring an API key for dLazy is plausible for a dLazy CLI, but it is not declared in the registry metadata and is unexpected given the 'Pixabay-like search' description. The instructions also state local files may be uploaded to remote storage (oss.dlazy.com), which increases the sensitivity of providing the API key.

Persistence & Privilege

always is false (good). The CLI will store the API key in a user config file (~/.dlazy/config.json) if used — a normal behavior for CLIs, but it grants persistent access to the dLazy account from the host. Autonomous agent invocation is allowed by default (not a standalone concern), but combined with the undisclosed credential requirement and upload behavior it increases blast radius.

Scan Findings in Context

[no_regex_findings] unexpected: The regex-based static scanner found no code-level findings (the skill is instruction-only). That absence is not evidence of safety; the SKILL.md itself contains operational instructions that require credentials and remote uploads which the static scanner couldn't flag.

What to consider before installing

This skill's description (searching public libraries like Pixabay) does not match its runtime instructions, which require installing @dlazy/cli, providing a DLAZY API key, and may upload local files to oss.dlazy.com. Before installing or using it: (1) Confirm you trust dlazy.com and review the GitHub repo and the npm package code (metadata points to github.com/dlazyai/cli and package @dlazy/cli@1.0.6). (2) If you only want to search public assets (Pixabay), do not provide your dLazy API key — this skill appears to perform generation/upload workflows instead. (3) Prefer running via npx (ephemeral) rather than a global npm install, and inspect the CLI behavior in a sandbox. (4) Consider asking the skill author to clarify why a search skill requires a private generation API and to declare required env vars in the registry metadata. If you cannot verify the package/repo, avoid installing or supplying credentials, and use an alternative verified Pixabay/Tried-and-tested search integration.

身份验证 (Authentication)

所有请求都需要 dLazy API key，通过 CLI 配置：

dlazy auth set YOUR_API_KEY

CLI 会把 key 保存在你的用户配置目录（macOS/Linux 上为 ~/.dlazy/config.json，Windows 上为 %USERPROFILE%\.dlazy\config.json），文件权限仅限当前操作系统用户访问。你也可以用 DLAZY_API_KEY 环境变量按次传入。

获取你的 API Key

1. 登录或在 dlazy.com 创建账号
2. 访问 dlazy.com/dashboard/organization/api-key
3. 复制 API Key 区域显示的密钥

每个 key 都属于你自己的 dLazy 组织，可在同一控制面板随时轮换或吊销。

关于与来源 (Provenance)

• CLI 源代码: github.com/dlazyai/cli
• 维护者: dlazyai
• npm 包名: @dlazy/cli（本技能 install 字段固定到 1.0.6 版本）
• 官网: dlazy.com

如果你不希望在系统上长期保留一个全局 CLI，可以按需运行：

npx @dlazy/cli@1.0.6 <command>

如选择全局安装，技能的 metadata.clawdbot.install 字段已固定到 npm install -g @dlazy/cli@1.0.6。安装前建议先到 GitHub 仓库审阅源码。

工作原理 (How It Works)

此技能是 dLazy 托管 API 的轻量封装。调用时：

• 你提供的提示词与参数会发送到 dLazy API（api.dlazy.com）进行推理。
• 传入图像 / 视频 / 音频字段的本地文件路径会被 CLI 上传到 dLazy 媒体存储（oss.dlazy.com），以便模型读取 —— 与任何云端生成 API 的流程一致。
• API 返回的生成结果 URL 由 oss.dlazy.com 托管。

这是标准的 SaaS 调用模式；技能本身不会越权访问网络或文件系统，所有动作都由 dLazy CLI 完成。

searchOnlineAssets (在线素材搜索)

English · 中文

这个技能用于调用在线公共素材库 (如 Pixabay) 搜索所需的高质量媒体资源，并能够将搜索结果信息和图片 URL 提供给当前工作流或对话环境使用。

适用场景

1. 当你缺少背景图片或参考图时，用于在互联网上快速找到自然、人物、科技等公共授权的免费素材。
2. 当用户请求需要寻找特定主题（如咖啡、城市风景）的照片、矢量图或视频作为视觉配图时。

技能要求与约束

• 你只能根据用户提供的关键字（优先翻译或使用英文获取更好结果）去检索对应类型的素材。
• 你可以指定 imageType 来筛选返回的资源类型（如 all，photo，illustration，vector，video）。
• 拿到结果后，提取并挑选最符合要求的 largeImageURL (对于图片) 或者对应的视频预览 URL 和 tags 提供给用户。
• 如果没有搜索到结果，你需要告知用户未能找到相关素材。

🛠️ 执行与生成指南 (CRITICAL EXECUTION INSTRUCTIONS)

你是可以执行终端命令的智能 Agent！

【严格禁止行为】

• 严禁：将提示词保存到任何文件中（如 txt, md）。
• 严禁：要求用户自己去第三方平台（如 Midjourney）生成图片。
• 严禁：一次性批量生成所有图片，或一次性执行多个命令。

【必须遵循的交互与执行流程】 你必须严格分步执行，并在每一步停下来等待用户回复：

1. 第一步：主动收集需求。当用户提出需求时，不要做任何设计和生成，先向用户提问（如产品特点、目标人群、想要几张图等）。必须等待用户回答。
2. 第二步：输出草案并请求确认。根据用户的回答，制定套图计划，并输出第一张图的提示词草案。询问用户：“是否确认这个提示词，可以开始生成第一张图了吗？” 必须等待用户回答“确认”。
3. 第三步：单次执行终端命令。用户确认后，你必须使用终端执行命令（如 dlazy seedream-4.5 --prompt "..."），每次只能执行一个生成命令。重要：必须使用同步命令，绝不要在命令末尾加 &，绝不要使用 &&，这是在 Windows PowerShell 下运行！
4. 第四步：交付与循环。命令返回结果后，把图片 URL 发给用户，并询问“对这张满意吗？我们可以继续生成下一张了吗？”。收到确认后再继续下一步。