Byted Byteplus Vod Video Enhancement
PassAudited by ClawScan on May 8, 2026.
Overview
This skill appears purpose-aligned, but it will use your BytePlus credentials to upload and process selected media in your VOD account.
Before installing, confirm you want an agent to upload selected media to BytePlus VOD and start restoration jobs using your account. Use least-privilege BytePlus credentials, keep .env files private, verify any file paths or URLs before running, and treat returned playback URLs or media references as sensitive.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Selected local files or URLs may be copied into BytePlus VOD storage and processed by BytePlus services.
The skill intentionally performs remote uploads and starts cloud processing jobs. That is coherent with the VOD purpose, but it is a high-impact action on user media and the BytePlus account.
Upload pipeline (local file): ApplyUploadInfo returns TOS upload address + SessionKey ... PUT file to TOS ... CommitUploadInfo ... Quality restoration pipeline: StartExecution/enhanceVideo
Use it only for media you intend to upload/process, and review the file path, URL, VOD space, and enhancement settings before running commands.
Anyone who can run the skill with these credentials can create uploads and restoration jobs in the configured VOD space.
The skill requires BytePlus account credentials and a VOD space to authenticate API calls. This is expected for the integration, but grants the scripts account authority for upload and processing actions.
BYTEPLUS_ACCESSKEY BytePlus Access Key ... BYTEPLUS_SECRETKEY BytePlus Secret Key ... VOD_SPACE_NAME VOD space name
Use a dedicated least-privilege key and VOD space where possible, keep .env files private, and rotate credentials if they may have been exposed.
Your environment may install or use versions of these packages that were not pinned by the skill artifact.
The runnable scripts depend on external Python packages with lower-bound version constraints and no lockfile or install spec shown. This is common for Python integrations but affects dependency provenance and reproducibility.
dependencies = [
"requests>=2.31.0",
"python-dotenv>=1.0.0",
]Install dependencies from trusted package sources and consider pinning/locking versions in controlled environments.
Media references or playable URLs could be exposed if copied into unrelated chats, logs, or untrusted downstream skills.
The skill encourages passing returned media references to downstream skills. This is part of the intended workflow, but the references identify uploaded media and should only be shared with trusted follow-up tools.
`Source`: a `vid://`-formatted reference that can be passed directly to follow-up skills such as `byted-mediakit`. The host agent should save the `Source` field for use in subsequent processing steps.
Keep returned Vid, directurl, and PlayURL values within the intended workflow and avoid sharing them with tools that do not need access.