The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the official Volcengine CLI (ve) to perform authentication and SMS management tasks. In scripts/api_client.py and scripts/sms_cli.py, the code uses subprocess.run and subprocess.Popen with list-based arguments to avoid shell injection vulnerabilities. The executed commands are restricted to the vendor-provided CLI tool.
[EXTERNAL_DOWNLOADS]: The skill provides automated remediation paths for installing the official @volcengine/cli package from the well-known NPM registry if it is not present on the host system. This is a trusted vendor resource used for legitimate service operations.
[INDIRECT_PROMPT_INJECTION]: The skill handles potentially untrusted external data from user-supplied CSV files and vendor API responses.
Ingestion points: User-provided recipient lists (CSV) are ingested via scripts/sms_cli.py and the local wizard in scripts/batch_wizard.py. API responses are ingested from ByteDance endpoints.
Boundary markers: Data processing occurs within a isolated Python environment; the agent only receives sanitized metadata (e.g., success status, record counts) and redacted summaries.
Capability inventory: The skill can execute the vendor CLI, communicate with first-party ByteDance domains (volcengineapi.com, bytedanceapi.com), and maintain local state in a private SQLite database.
Sanitization: scripts/api_client.py implements a robust redaction system that recursively removes sensitive keys (AK/SK, tokens, tickets) and masks PII (phone numbers, ID cards) before any data is projected to the model output context.

byted-sms-sender