volcengine-cli

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes the ve (Volcengine CLI) command and several internal helper scripts (scripts/ve_login_remote.sh, scripts/call_extend_api.py) to manage cloud infrastructure. These operations are essential to the skill's primary purpose. Safety guidelines are included to ensure the agent requests user confirmation before performing write or destructive operations.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the official Volcengine CLI via npm i -g @volcengine/cli and fetches API metadata from official Volcengine domains (api.volcengine.com). These are trusted vendor resources.
  • [DATA_EXPOSURE]: The helper script scripts/call_extend_api.py reads the local Volcengine configuration file (~/.volcengine/config.json) to resolve credentials. This is standard behavior for a cloud CLI integration. The skill's instructions explicitly forbid the agent from displaying the contents of this file to the user to prevent credential leakage.
  • [COMMAND_EXECUTION]: The script scripts/ve_login_remote.sh manages the OAuth login process by launching a background ve login process and using a named pipe (FIFO) in /tmp to handle the authorization code. The script uses mkfifo -m 600 to ensure the pipe is only accessible by the owner.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 09:27 AM
Security Audit — agent-trust-hub — volcengine-cli