Security audit
Security checks for vulnerabilities and agentic risk
This is a non-executable Volcengine guide with a risky copy-paste credential example, but no hidden behavior or automatic access.
Before installing or using this skill, treat it as high-level guidance only. Do not paste real Volcengine Access Keys or Secret Keys into source code; load them from environment variables or a secrets manager, use least-privilege credentials, and choose the correct Volcengine region for your account and deployment.
The example explicitly initializes the client with a Beijing-region endpoint and cn-beijing, which imposes a specific locale in natural-language guidance and code. The file does not offer an alternative region selection or explain that this is a region-specific example, so it can conflict with language/locale neutrality expectations.
The code sample explicitly hardcodes placeholder access and secret keys immediately after advising readers to use environment variables. In a skill about deploying AI agents and cloud infrastructure, users may copy this pattern into real systems, leading to credential exposure in source control, logs, screenshots, or shared skill repositories and enabling unauthorized access to Volcengine resources.
No suspicious patterns detected.
