volcengine-cli

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the Volcengine CLI via a shell script downloaded from the vendor's CDN (https://cloudcache.volccdn.com/ve/install.sh). The installation script performs platform detection and integrity verification using SHA256 checksums.
  • [COMMAND_EXECUTION]: Core functionality is achieved by executing the ve CLI and supporting Python and shell scripts (scripts/ve_login_remote.sh, scripts/call_extend_api.py) to manage cloud resources and authentication states.
  • [DATA_EXFILTRATION]: The skill's scripts access local configuration files (~/.volcengine/config.json) and environment variables to resolve authentication credentials (Access Keys and Secret Keys). These credentials are used solely for authenticating requests to official Volcengine API endpoints.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from API responses (e.g., resource IDs, status messages) and user-provided parameters. It implements safety protocols, including read-only defaults and mandatory user confirmation for write or destructive operations, to reduce the risk of accidental or malicious command execution.
  • [DYNAMIC_EXECUTION]: The scripts/audit_extend_apis.py utility uses dynamic module loading to inspect the API registry within the companion scripts/call_extend_api.py file, allowing it to compare defined extensions against the current CLI version's native capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:24 PM