volcengine-find-skills

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/find_skills.py uses the subprocess.run method to execute the npx skills command. This is used to query installed skills and perform new installations. The script mitigates command injection risks by passing command arguments as a list rather than a shell-interpreted string.\n- [REMOTE_CODE_EXECUTION]: The skill provides a mechanism to download and execute code from the volcengine/volcengine-skills repository. This behavior is the primary purpose of the skill, enabling the agent to dynamically extend its capabilities by installing other specialized Volcengine tools.\n- [EXTERNAL_DOWNLOADS]: The skill performs network requests to GitHub and NPM registries to fetch and install new packages. It defaults to the vendor's official repository for all skill installations.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 12:03 PM
Security Audit — agent-trust-hub — volcengine-find-skills