byted-kickart-viral-replicator
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.Popeninscripts/replication.pyto spawn a background worker for polling task status. This is a legitimate architectural pattern for command-line tools that handle asynchronous video generation tasks. The commands target the skill's own scripts and are invoked using argument lists, preventing shell injection. - [EXTERNAL_DOWNLOADS]: The skill implements a parallel downloader using
aiohttpto fetch media assets. These downloads target vendor-controlled domains (e.g.,bytednsdoc.com) and authorized social media platforms (e.g., Douyin/Douyin Shop) as required for the primary video cloning functionality. - [CREDENTIALS_UNSAFE]: The skill requires Volcengine cloud credentials (AK/SK) or Ark Tokens for its core functionality. It implements a robust authentication strategy via environment variables and provides clear, security-conscious guidelines to users regarding temporary session usage and minimal permission principles.
- [DATA_EXFILTRATION]: All network operations are directed to official ByteDance and Volcengine API endpoints (
volcengineapi.com). No suspicious data transmission to unauthorized or third-party domains was observed during analysis.
Audit Metadata