byted-byteplus-vod-frame-extraction
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts to handle VOD operations. User-provided file paths are strictly validated against a whitelist of allowed directories (such as the workspace, /tmp, and project-specific folders) before being processed, which effectively mitigates path traversal and arbitrary file access risks.
- [DATA_EXFILTRATION]: While the skill transmits media data and generates signed URLs, this is the intended functionality of a VOD management tool. The scripts interact exclusively with legitimate infrastructure owned by BytePlus and Volcano Engine (e.g., *.byteplusapi.com, *.volcengineapi.com), ensuring that data remains within the expected ecosystem.
- [CREDENTIALS_UNSAFE]: No hardcoded API keys or secrets were found. The skill correctly utilizes environment variables and
.envfiles for authentication, with documentation guiding the user on safe secret management. - [EXTERNAL_DOWNLOADS]: The skill specifies standard, reputable dependencies (
requests,python-dotenv) in its configuration. No suspicious or unversioned remote scripts are downloaded or executed.
Audit Metadata