The Agent Skills Directory

[SAFE]: The skill implementation leverages the official Volcengine SDK from a trusted vendor (Beijing Volcano Engine/ByteDance). The behavior matches the described purpose with no evidence of malicious intent or hidden capabilities.
[CREDENTIALS_UNSAFE]: Sensitive credentials like API keys are accessed through environment variables (MODEL_IMAGE_API_KEY, ARK_API_KEY, etc.), which is the recommended method for secure credential management.
[EXTERNAL_DOWNLOADS]: The script uses urllib.request.urlretrieve to download generated assets from the Volcengine API platform. These downloads are part of the intended functionality and originate from trusted vendor infrastructure.
[COMMAND_EXECUTION]: The skill uses a script-based approach where inputs are handled as arguments. The code lacks dangerous sinks such as eval() or unsanitized shell executions, ensuring that user-provided prompts are treated strictly as data.

image-generate