byted-skillhub-download
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions provide the agent with a specific command to execute a local Python script (
scripts/download_from_skillhub.py) using strictly controlled parameters for downloading internal resources. - [EXTERNAL_DOWNLOADS]: The Python script performs network operations to fetch zip files from an API host defined by the environment variable
ARK_SKILL_API_BASE. These operations target the vendor's own infrastructure (Bytedance SkillHub) and utilize standard Python libraries (urllib.request). - [CREDENTIALS_SAFE]: The skill correctly follows secret management best practices by instructing the agent to use environment variables (
ARK_SKILL_API_KEY) already injected into the runtime context, explicitly warning against asking the user for sensitive information.
Audit Metadata