byted-kickart-marketing-material-generator

Pass

Audited by Gen Agent Trust Hub on Apr 21, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the subprocess module in scripts/consumption.py and scripts/publish.py to manage background processes. Specifically, it executes a local bash script (poll.sh) for task status monitoring and the platform's openclaw CLI for sending messages and media to the user upon task completion.
  • [CREDENTIALS_UNSAFE]: Diagnostic logging in scripts/servicev1.py and scripts/servicev2.py records full HTTP request headers to a log file in /tmp/openclaw/kickart/. These logs may include authentication tokens or signatures. However, the skill provides explicit instructions to users in references/火山鉴权指南.md on how to handle secrets securely using environment variables and temporary sessions.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with Volcengine's official API infrastructure (icp.volcengineapi.com) to perform its core functions. These network operations are necessary for service integration and target the vendor's trusted domains.
  • [SAFE]: The skill demonstrates secure design patterns, including domain-specific URL validation for product links, mandatory authentication checks before processing data, and the use of unique task identifiers to prevent accidental redundant resource consumption.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 21, 2026, 10:40 AM