byted-util-ark-cua
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/bootstrap-agent.pyscript downloadscredential-agentbinaries from ByteDance's official Volcengine artifact storage (volces.com). The script includes a custom implementation of Ed25519 signature verification and SHA-256 hashing to ensure the integrity of the downloaded binaries before execution. - [COMMAND_EXECUTION]: Several scripts (e.g.,
scripts/cua.py,scripts/prepare-source.py,scripts/sync-cua.py) utilizesubprocess.runandsubprocess.Popento interact with the system CLI (arkcli) and the internalcredential-agent. These operations are scoped to authentication, environment setup, and task coordination required for the cloud desktop's functionality. - [DATA_EXFILTRATION]: The skill accesses sensitive authentication state in
~/.arkcliand stores API keys in~/.openclaw/ark-cua/auth.json. However, it adheres to security best practices by using0600file permissions to prevent unauthorized local access and communicating only with authorized ByteDance/Volcengine API gateways. - [INDIRECT_PROMPT_INJECTION]: The skill acknowledges that content retrieved from the cloud desktop or web pages is untrusted. The instructions include explicit guardrails for the AI agent to ignore any instructions embedded in CUA output or downloaded files that attempt to override user requests or safety rules.
Audit Metadata