byted-byteplus-vod-precision-erasure
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill provides functionality to interact with BytePlus Video on Demand services.
- [DATA_EXFILTRATION]: The skill implements a security check in
scripts/upload.pycalled_validate_local_path. This function ensures that the agent can only upload files from the workspace,/tmp, or explicitly allowed directories, effectively preventing the accidental or malicious exfiltration of sensitive system files like SSH keys or environment secrets. - [COMMAND_EXECUTION]: The skill executes local Python scripts to perform VOD operations. The command-line arguments are parsed safely using standard libraries, and no dynamic code execution (like eval) is present.
- [EXTERNAL_DOWNLOADS]: The skill communicates with official BytePlus and Volcengine API endpoints (
byteplusapi.com,volcengineapi.com) to manage media. These are recognized vendor resources for the skill author (bytedance). - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided file paths and JSON parameters. While this represents an ingestion surface, the implementation uses strict path validation and structured JSON parsing to mitigate potential injection risks.
Audit Metadata