The Agent Skills Directory

[DATA_EXPOSURE]: The skill is designed to manage cloud credentials (VOLCENGINE_AK, VOLCENGINE_SK) stored in a .env file to authenticate with Volcengine APIs. This follows standard industry practices for local development tools.
[INDIRECT_PROMPT_INJECTION]: The tool possesses an attack surface as it ingests untrusted external data from topology.json files and cloud service responses. Maliciously crafted resource metadata or topology structures could theoretically attempt to influence the agent's interpretation, but the risk is low due to the specialized nature of the auditing logic.
Ingestion points: topology.json files and Volcengine OpenAPI responses.
Boundary markers: Absent; data is processed directly into audit reports.
Capability inventory: File system read access and network requests via official cloud SDKs.
Sanitization: Standard JSON parsing is used without explicit output escaping for report generation.
[DYNAMIC_EXECUTION]: The test suite tests/test_run_capacity_audit.py employs importlib to dynamically load the skill's main script for unit testing. This is a common development pattern and is restricted to the local file system.

byted-volcengine-capacity-auditor