Volcengine Security Kms

• Outcome: Pass
• Latest audit: May 28, 2026, 11:43 AM
• Version:
  1.0.0

Overview

This is a small instruction-only helper for Volcengine KMS key management, with no evidence of hidden code or unrelated behavior.

Install this only if you want an agent to assist with Volcengine KMS. Use least-privilege IAM credentials limited to the intended projects and keys, and require explicit confirmation before creating keys, decrypting data, signing, rotating keys, or changing key policies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Low

• Confidence: 82% confidence
• Finding: The default prompt says to use the skill for 'this key management request' without defining the exact scope, trigger phrases, or exclusion conditions. In a manifest file, this can be too open-ended because it does not clarify when requests should be routed elsewhere versus invoking this skill.

VirusTotal

66/66 vendors flagged this skill as clean.