Security audit
Security checks across malware telemetry and agentic risk
This is mostly a Markdown API guide, but it asks for broader agent permissions than its documented free chat-helper purpose needs.
Install only if you are comfortable with a skill that can run commands and is declared with write access. Treat all prompts, files, or credentials used with its API examples as data that may leave your environment, and replace the placeholder endpoint only with an approved Doubao/API endpoint. The publisher should remove or narrowly justify write permission and narrow the trigger wording before this is low-risk.
const sessionId = process.env.DOUBAO_SESSIONID;
// ...
async function chat(message) {
const resp = await fetch('https://api.example.com/v1/chat/completions', {
method: 'POST',
headers: {
'Content-Type': 'application/json'const sessionId = process.env.DOUBAO_SESSIONID;
// ...
async function chat(message) {
const resp = await fetch('https://api.example.com/v1/chat/completions', {
method: 'POST',
headers: {
'Content-Type': 'application/json'VirusTotal findings are pending for this skill version.
No suspicious patterns detected.