volcengine-cli
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
ve(Volcengine CLI) command and several internal helper scripts (scripts/ve_login_remote.sh,scripts/call_extend_api.py) to manage cloud infrastructure. These operations are essential to the skill's primary purpose. Safety guidelines are included to ensure the agent requests user confirmation before performing write or destructive operations. - [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the official Volcengine CLI via
npm i -g @volcengine/cliand fetches API metadata from official Volcengine domains (api.volcengine.com). These are trusted vendor resources. - [DATA_EXPOSURE]: The helper script
scripts/call_extend_api.pyreads the local Volcengine configuration file (~/.volcengine/config.json) to resolve credentials. This is standard behavior for a cloud CLI integration. The skill's instructions explicitly forbid the agent from displaying the contents of this file to the user to prevent credential leakage. - [COMMAND_EXECUTION]: The script
scripts/ve_login_remote.shmanages the OAuth login process by launching a backgroundve loginprocess and using a named pipe (FIFO) in/tmpto handle the authorization code. The script usesmkfifo -m 600to ensure the pipe is only accessible by the owner.
Audit Metadata