byted-outbound-call

Warn

Audited by Socket on Sep 21, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/volc/volc_openai.py

The code is primarily a Volcengine API client implementing HMAC authentication. It does not show clear malware, persistence, command execution, or covert network exfiltration. However, the direct execution path deliberately prints VOLCENGINE_SECRET_KEY and sends hardcoded personal data to the Volcengine service. Credential printing should be removed, sensitive sample data should be replaced, and the unreachable sys.exit(1) should be reviewed.

Confidence: 98%Severity: 55%
Audit Metadata
Analyzed At
Sep 21, 2026, 03:16 PM
Package URL
pkg:socket/skills-sh/bytedance%2Fagentkit-samples%2Fbyted-outbound-call%2F@2c3f11f4771851fadba6b9a389b20343b15f9531bd86040c43d93d8a55467822