byted-volcengine-vmp
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the 'volcengine-python-sdk', which is the official library provided by the vendor (ByteDance/Volcano Engine) for interacting with their cloud infrastructure.
- [COMMAND_EXECUTION]: The skill provides several Python scripts, such as 'query_metrics.py' and 'list_workspaces.py', which are used to interact with Volcano Engine API endpoints (e.g., volcengineapi.com) to retrieve monitoring data.
- [DATA_EXFILTRATION]: The skill's configuration logic reads sensitive cloud credentials (VOLCENGINE_AK and VOLCENGINE_SK) from the local file system path '~/.openclaw/workspace/.env'. This access is intended for authenticating API requests to the official service provider and is consistent with the skill's stated purpose of managing cloud resources.
Audit Metadata