byted-volcengine-cloudmonitor
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses official ByteDance/Volcengine SDKs (
volcengine-python-sdk) and communicates exclusively with official vendor domains (volcengine.com). - [DATA_EXPOSURE]: The script
scripts/get_metric_data.pyretrieves credentials from standard local paths including~/.volcengine/config.jsonand~/.openclaw/workspace/.env. This is consistent with secure development practices for managing cloud credentials locally rather than hardcoding them. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied parameters and external monitoring data. It mitigates injection risks by providing structured JSON output options and using formal SDK methods for API interactions.
- Ingestion points: User-provided CLI arguments and Volcengine API responses in
scripts/get_metric_data.py. - Boundary markers: The script supports structured JSON output and uses distinct headers for text-based reports.
- Capability inventory: Perform network requests via Volcengine SDK and read local configuration files.
- Sanitization: Relies on the type-safe constraints of the
volcengine-python-sdkmodels.
Audit Metadata