skills-registration
Pass
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Python script that interacts with the local file system to package skills.
- It uses the
zipfilemodule to archive local directories into a.zipfile located in theoutputs/directory. - It utilizes
argparseto accept local directory paths from the user. - [EXTERNAL_DOWNLOADS]: The script performs network operations to upload data and register services with Volcengine.
- It connects to
sts.volcengineapi.comto retrieve account identity information using STS (Security Token Service). - It uploads the generated zip archive to Volcengine TOS (TOS) via the
VeTOSclient. - It makes API calls to
open.volcengineapi.comto register the skill using theCreateSkillaction. - [CREDENTIALS_UNSAFE]: The skill manages cloud credentials to perform its registration tasks.
- It requires
VOLCENGINE_ACCESS_KEYandVOLCENGINE_SECRET_KEYenvironment variables. - The instructions in
SKILL.mdguide the AI agent to assist the user in setting up these credentials by writing them to a workspace environment file if they are missing. This is a standard setup helper and does not involve hardcoded secrets.
Audit Metadata