byted-data-label
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/seederive.pyscript usessubprocess.check_callto automatically install therequestslibrary if it is missing from the environment. - [EXTERNAL_DOWNLOADS]: The skill fetches the
requestspackage from the official Python Package Index (PyPI) at runtime to facilitate API communication. - [PROMPT_INJECTION]: The skill processes external data (CSV, Excel, JSON) for labeling tasks, which creates a surface for indirect prompt injection. This is a characteristic of the tool's primary purpose for data labeling.
- Ingestion points: The
scripts/seederive.pyscript reads user-provided data via arguments like--file,--raw-data, and--raw-data-fileacross various management tasks. - Boundary markers: There are no explicit markers or instructions used to delimit the untrusted user data from the system prompts during processing.
- Capability inventory: The skill is capable of performing network requests to Volcengine's API gateway, reading and writing local files, and executing package installation commands.
- Sanitization: No specific sanitization or filtering logic was identified for the content of the data ingested from external files.
Audit Metadata