Volcengine Ai Entry Ark

Entry skill for Volcengine ARK model invocation and routing. Use when users ask to start with ARK, need request templates, endpoint setup, model routing, or authentication troubleshooting.

Security Scan

The skill provides a legitimate-looking ARK request template and troubleshooting steps, but metadata and instructions conflict (it asks for an API key in SKILL.md but declares no required env), and the example endpoint hostname appears incorrect/suspicious — proceed cautiously.

Purpose & Capability

Name/description, the prompt archetype (routing ARK requests), and the included request template are coherent: the skill's stated purpose (helping with Volcengine ARK invocation, templates, routing, and troubleshooting) matches the SKILL.md content.

Instruction Scope

SKILL.md explicitly instructs the agent to collect ARK_API_KEY and to run a curl against an ARK endpoint. That is within the claimed scope, but the example uses the host 'ark.cn-beijing.volces.com' (note: 'volces.com' looks like a typo or malicious domain versus expected 'volcengine.com' or an official volcengine domain). The instructions do not request or read arbitrary local files or other credentials, but they do guide the agent to collect a sensitive API key and send it to an endpoint whose hostname should be verified.

Install Mechanism

Instruction-only skill with no install spec and no code files — nothing is written to disk and no third-party packages are pulled in, which lowers installation risk.

Credentials

SKILL.md lists ARK_API_KEY and endpoint ID as inputs to collect, but the skill metadata declares no required environment variables or primary credential. This mismatch is an incoherence: the skill will prompt for/expect a sensitive API key but the registry metadata does not advertise or gate that need. Requesting a single ARK API key is proportional to the stated purpose, but the omission in metadata and the suspicious endpoint hostname raise concerns about where a key would be transmitted.

Persistence & Privilege

No always:true, no config paths, no installs, and no modification of other skills' configs. The skill is user-invocable and can be invoked autonomously (platform default), which is expected for skills of this type.

What to consider before installing

The skill's content itself looks like a normal ARK request helper, but there are two red flags you should address before entering secrets: (1) the SKILL.md asks you to provide ARK_API_KEY yet the registry metadata lists no required env/primary credential — confirm with the publisher why the metadata omits this and whether the skill will store or transmit the key; (2) verify the example endpoint hostname (ark.cn-beijing.volces.com). That domain does not match expected volcengine hostnames and could be a typo or a malicious endpoint. Only provide your real API key after you confirm the correct official endpoint and the publisher's identity (or test with a revoked/dummy key first). If you can't verify the source, do not enter secrets and prefer using official Volcengine docs or an official SDK/integration instead.

Route generic ARK model requests to the right task-specific skill and provide a minimal runnable starting point.

Inputs to Collect

• ARK_API_KEY
• Model endpoint ID (for example: ep-xxxx)
• Task type (chat, summarization, coding, translation)
• Optional generation params (temperature, max_tokens, top_p)

Minimal request template

curl https://ark.cn-beijing.volces.com/api/v3/chat/completions \
  -H "Authorization: Bearer $ARK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "ep-xxxx",
    "messages": [
      {"role":"system","content":"You are a helpful assistant."},
      {"role":"user","content":"Hello"}
    ],
    "temperature": 0.2
  }'

Troubleshooting Checklist

• 401: verify ARK_API_KEY and key scope
• 404: verify endpoint region/domain and endpoint ID
• 429: reduce request rate and add retries with backoff
• 5xx: retry with jitter and keep request logs for support

References

• references/sources.md