byted-antiddospro-hostops
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with Volcengine's official API endpoint at
open.volcengineapi.comto retrieve monitoring metrics and configuration status. These network operations are legitimate requests to the vendor's own infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from external AntiDDoSPro API responses.
- Ingestion points: Data is fetched from the network via the diagnostic functions defined in
scripts/advdefence_client.py. - Boundary markers: The
SKILL.mdfile provides explicit instructions for the agent to be conservative in its analysis, requiring it to distinguish between 'no data' and 'no risk'. - Capability inventory: The skill utilizes the
requestslibrary to perform authenticated GET and POST operations against vendor infrastructure. - Sanitization: The agent is instructed to summarize the findings from the parsed JSON data rather than outputting raw payloads.
- [SAFE]: The skill implements secure credential management by fetching required API keys (
VOLC_ACCESS_KEYandVOLC_SECRET_KEY) from system environment variables, avoiding the use of hardcoded secrets or sensitive inputs in the conversation context.
Audit Metadata