Byted Las Audio Convert

This skill appears to legitimately wrap Volcengine LAS audio conversion, but there are transparency and supply-chain concerns you should address before installing or running it: - The SKILL.md requires LAS_API_KEY and LAS_REGION, and may require VOLCENGINE_ACCESS_KEY/VOLCENGINE_SECRET_KEY for some workflows, but the registry metadata lists no required env vars. Expect to provide cloud credentials if you run it. - The initialization script (scripts/env_init.sh) fetches a remote manifest and pip-installs a .whl from https://las-ai-cn-beijing-online.tos-cn-beijing.volces.com/. That means code will be downloaded and executed at runtime — treat this like installing third-party software. If you must run it, do so in a disposable sandbox or VM. - The scripts assume binaries (lasutil, ffprobe, jq, python3) are available; the skill metadata does not declare these dependencies. Make sure those binaries are present and trusted or run in an environment where you control them. - If you plan to provide API keys: only provide the minimum-scoped credentials, and avoid using highly privileged keys on sensitive machines. Consider creating a dedicated LAS key with restricted permissions and verifying which operations require VOLCENGINE access keys. - If you want to install safely: inspect the remote manifest and the wheel before execution (download the .whl manually, inspect contents, check signatures or checksums if available), or ask the skill author/owner for the upstream source and a signed release. Ask the publisher to update the registry metadata to list required env vars and binaries and to host the SDK/wheels on a well-known release channel. Given the inconsistencies and the remote pip install behavior, treat this skill as suspicious until metadata and install behavior are clarified or you vet the remote wheel and manifest.