Byted Vefaas Skills

This skill appears to be a normal guide for the Volcengine veFaaS CLI, but there are a few red flags you should consider before installing or running its commands: - Source provenance: the skill gives an npm tarball URL rather than a GitHub release or well-known package registry and the registry metadata has no homepage or source. Verify the install URL with an official Volcengine/veFaaS page before running it. - Installing risk: npm i -g <tarball> will execute code from that tarball. If you can't confirm the origin, avoid installing globally on your main machine; consider using an isolated environment (container/VM) or inspecting the tarball contents first. - Credentials and secrets: the docs instruct uses of VOLC_ACCESS_KEY_ID/VOLC_SECRET_ACCESS_KEY, SSO, and importing .env files. Expect credentials to be stored under ~/.vefaas/auth.json and debug logs to contain full API responses — review and secure those files and avoid importing files that contain unnecessary secrets. - Least privilege: if you must use AK/SK, create keys with minimal privileges (not root/admin) and rotate them after use. - Audit logs/config: after use, inspect ~/.vefaas/ (logs and auth.json) and remove any sensitive files you don't want persisted. Prefer SSO or short-lived STS tokens where possible. If you cannot verify the install URL or vendor provenance, do not install globally on a trusted host.