Seedream

• Analyzed: May 12, 2026, 4:10 AM
• Findings: 1
• Version: 0.1.0
• Hash: 8a7c1f94a49d243c9b8209c0b8ac6c18b691eafba625912322d9895ddd00c425
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is a straightforward wrapper for the Volcengine Seedream API. It correctly handles API keys via command-line arguments or environment variables and sends them to the legitimate Volcengine API endpoint (ark.cn-beijing.volces.com) as part of the `Authorization` header. The `SKILL.md` provides clear, benign instructions for the agent, including how to display generated image URLs. The `generate_image.py` script uses the `requests` library for HTTP communication, without any signs of arbitrary code execution, unauthorized data exfiltration, persistence mechanisms, or obfuscation. All actions are aligned with the stated purpose of generating images via a third-party API.