by 安全扫描
OpenClaw
可疑
medium confidence该技能的既定目的（通过 dlazy CLI 生成视频）看似合理，但存在不匹配和缺失声明——最突出的是它需要 dLazy API 密钥，并建议全局 npm install，却未声明任何凭据或安装规范——因此请谨慎验证。
评估建议
This 技能 应用ears to be a thin wr应用er around a third-party 命令行工具 (@dlazy/命令行工具) to 生成 videos. Before 安装ing or using it: 1) 验证 the npm package and publisher (@dlazy/命令行工具@1.0.6) on npmjs.com and confirm dlazy.com is a legitimate site; the 技能 has no homepage/source. 2) Be aware the 技能 requires your dLazy API key (it tells you to 运行 `dlazy auth 设置 <key>`), but that 凭证 was not declared in the registry metadata—do not paste secrets into chat; prefer 设置ting them locally and confirm how the 命令行工具 stores t...详细分析 ▾
ℹ 用途与能力
Name/description (Kling v3 Omni video generation) match the instructions to 运行 a dlazy 命令行工具. Requiring npm/npx is reasonable for a Node-based 命令行工具. However the 技能.md instructs use of an API key (dlazy auth 设置) but the 技能 metadata/registry 列出s no required 环境 variables or primary 凭证—this omission is inconsistent.
ℹ 指令范围
运行time instructions are narrowly focused: 运行 `dlazy kling-v3-omni`, pass prompt/images/videos, and handle error codes. They explicitly allow local file paths (images/videos), so the 代理 may read arbitrary user files when asked to attach media—this is expected for media-generation but should be noted. The instructions also include mandatory behavior (MUST 信息rm user about insufficient_balance/un授权d) which is normal but prescriptive.
⚠ 安装机制
There is no formal 安装 spec in the registry, but the 技能.md metadata contAIns an 安装ation instruction: `npm 安装 -g @dlazy/命令行工具@1.0.6`. A global npm 安装 will 执行 code from the npm registry and 创建 persistent binaries; that is a moderate-risk action and should be declared explicitly in the registry 安装 spec or provenance verified. No homepage/source is provided to 验证 the package 身份.
⚠ 凭证需求
The 技能 requires a dLazy API key (instructions tell the user to 运行 `dlazy auth 设置 YOUR_API_KEY`) but the registry metadata 列出s no required env vars or primary 凭证. This is an inconsistency: a 凭证 is necessary for the 技能 to function but wasn't declared. Also, because the 命令行工具 can read local file paths provided by the user, the 代理 may 访问 arbitrary files—expected for media 输入 but worth calling out.
✓ 持久化与权限
The 技能 is not marked 'always: true' and does not 请求 elevated 平台 privileges. The only persistence implied is the possible global npm 安装 of a 命令行工具 (see 安装_mechanism). The 技能 does not 请求 modification of other 技能s or 系统-wide 代理 config beyond 安装ing/using its own 命令行工具.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.22026/4/21
- 更新了处理 API key 提交的 agent 指令：现要求保存提供的 key 并继续任务。 - 调整了请求 API key 时的 agent 消息，移除此前要求用户先发送 key 给 agent 再保存的步骤。 - CLI 选项与 API 行为无变动。
● Pending
安装命令
点击复制官方npx clawhub@latest install dlazy-kling-v3-omni
镜像加速npx clawhub@latest install dlazy-kling-v3-omni --registry https://cn.longxiaskill.com
技能文档
- | ------------------------------ | -------------------------------------------------------- |
ok: false, code: "unauthorized", message: "API key is missing or invalid" |
| 501 | 缺少必填参数 | error: required option '--prompt ' not specified |
| 502 | 本地文件读取错误 | Error: Image file/Video file not found: C:\path\to\your\file |
| 503 | API 请求失败（余额不足） | ok: false, code: "insufficient_balance" |
| 503 | API 请求失败（服务器错误） | HTTP status code error (500 server crash) |
| 504 | 异步任务执行失败 | === Generation Failed === / {后端返回的具体错误原因，如“Prompt violates safety policy”} | 代理关键指令：
1. 若返回code: "insufficient_balance"，必须明确告知用户余额不足并引导充值：https://dlazy.com/dashboard/organization/settings?tab=credits