Byted Data Deepresearch Structured2markdown

This skill appears to do what it claims (send spreadsheets to VolcEngine/DataAgent and return Markdown), but there are a few red flags you should consider before installing or running it: - Metadata mismatch: the registry summary showed no required env vars but SKILL.md requires VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY. Verify which is authoritative. - Credential handling: SKILL.md asks you to provide AK/SK interactively, store them in shell variables, and pass them on the command line. That can leak secrets to process listings and shell history. Prefer environment variables, ephemeral session tokens, or other safer methods; avoid typing long-lived secrets unless you accept the risk. - Dependency/install gaps: the instructions ask you to pip install volcengine-python-sdk but the script also imports requests and requests_toolbelt; ensure you install all required packages and inspect what is being installed. Consider running pip install inside an isolated environment you control and review versions before running. - Opacity: the skill forbids printing its self-checks and install steps to users. That makes it harder to audit what actually ran. If you proceed, run the self-check commands yourself (visible) and verify network calls (for example with a firewall or network monitor) before sending sensitive data. - Source provenance: the skill claims a ByteDance copyright and uses VolcEngine endpoints, but source and homepage are unknown. If you will upload sensitive data, confirm the service and operator are acceptable. What to do next: inspect the full script locally, run it in an isolated environment (not on sensitive data), verify network endpoints (data-agent.volcengineapi.com), add missing Python deps manually, and avoid passing long-lived AK/SK on the command line. If you are not comfortable providing VolcEngine credentials, do not install or run this skill.