volcengine-find-skills
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/find_skills.pyuses thesubprocess.runmethod to execute thenpx skillscommand. This is used to query installed skills and perform new installations. The script mitigates command injection risks by passing command arguments as a list rather than a shell-interpreted string.\n- [REMOTE_CODE_EXECUTION]: The skill provides a mechanism to download and execute code from thevolcengine/volcengine-skillsrepository. This behavior is the primary purpose of the skill, enabling the agent to dynamically extend its capabilities by installing other specialized Volcengine tools.\n- [EXTERNAL_DOWNLOADS]: The skill performs network requests to GitHub and NPM registries to fetch and install new packages. It defaults to the vendor's official repository for all skill installations.
Audit Metadata