byted-vms-number-pool
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to the official Volcano Engine API endpoint (
cloud-vms.volcengineapi.com) to manage number pools and qualifications. This is an expected behavior for a cloud management tool and targets a well-known service associated with the author (ByteDance). - [COMMAND_EXECUTION]: The skill operates by executing a local Python script (
scripts/number_pool.py) that implements various management commands. All operations are confined to the intended functionality of interfacing with the VMS service. - [PROMPT_INJECTION]: The skill processes structured data from the Volcano Engine API (e.g., qualification lists, number pool details). While this data represents an indirect prompt injection surface if a resource name were maliciously crafted in the backend, the risk is mitigated by the use of structured JSON responses and standard agent guardrails.
- [CREDENTIALS_UNSAFE]: The skill correctly handles sensitive credentials (API keys and secrets) by retrieving them from environment variables (
VOLC_ACCESS_KEY,VOLC_SECRET_KEY,ARK_SKILL_API_KEY) rather than hardcoding them in the source code.
Audit Metadata