Byted Acep Api

• Outcome: Review
• Latest audit: Jul 15, 2026 · 1:45 PM UTC
• Version: 1.2.0

Overview

This skill is a disclosed cloud-phone administration tool, but it exposes high-impact actions such as remote command execution, billing/resource changes, destructive deletion, and a generic raw API caller with limited built-in guardrails.

Install only if you intend to let an agent administer Volcengine cloud phone resources. Use least-privilege test credentials, keep config.json and signed URLs private, require explicit confirmation before any create/delete/billing/network/file/command action, and avoid using the generic action-call unless you have reviewed the exact OpenAPI action and parameters.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill exposes powerful operational capabilities through a local Python CLI and OpenAPI client, including file transfer, command execution, network access, and resource lifecycle operations, but it does not declare permissions. That mismatch can cause the agent or reviewer to underestimate the skill's effective authority, increasing the chance of unsafe use, secret exposure, or unintended infrastructure changes.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This client exposes a much broader set of privileged actions than the skill description suggests, including creation, deletion, migration, backup/restore, network configuration, and billing-affecting resource lifecycle operations. That capability mismatch increases the chance an agent or user can invoke high-impact APIs outside the expected troubleshooting scope, violating least privilege and enabling unsafe actions if the skill is misused or prompted adversarially.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The client provides direct remote command execution on cloud phone instances through both async and sync command paths. In an agent context, arbitrary command execution is highly dangerous because prompt-influenced inputs could lead to unauthorized actions, data access, persistence changes, or further compromise of managed instances.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The client can subscribe, renew, and unsubscribe resources, which can create financial exposure and materially alter infrastructure state. Because the skill is framed as cloud phone management and troubleshooting, these billing and lifecycle controls materially expand risk and could be abused by a compromised agent flow or accidental invocation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The CLI exposes destructive instance deletion, including a force-destroy path, without any interactive confirmation, dry-run, or explicit guardrail in this file. In an operational tool for managing cloud phone resources, a mistyped ID, copied command, or automated invocation can permanently destroy running resources and associated state.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: This command deletes user data specified by file paths and packages without any confirmation or safety prompt. In the context of a cloud-device management CLI, this is particularly dangerous because the operation is irreversible, can target multiple paths, and may wipe application data or evidence needed for troubleshooting.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Backup data deletion is irreversible but is exposed without any warning or confirmation in this file. Since backups are often the recovery path after mistakes or incidents, accidental or scripted deletion can materially worsen outage and data-loss scenarios.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The CLI exposes a destructive unsubscribe operation that can remove paid cloud phone resources, but it performs the action immediately without an interactive confirmation, dry-run, or explicit acknowledgement gate. In an operations tool managing real infrastructure, this increases the chance of accidental resource deletion, service disruption, and unexpected billing or availability impact from mistyped IDs or automation mistakes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The delete pod wrapper performs a destructive operation without any built-in confirmation, dry-run, or warning mechanism. In an agent-driven environment, that makes accidental deletion or prompt-induced destructive execution more likely, especially when pod identifiers come from prior automated steps.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The remote file deletion method removes pod data without requiring any explicit acknowledgement or safety interlock. This can lead to accidental data loss or malicious prompt-driven cleanup of application files, logs, or user data on managed devices.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The pull_file method writes remotely retrieved data directly to a local filesystem path, defaulting to the current working directory, without any disclosure or policy guard. In an agent setting, silent materialization of remote data locally can leak sensitive files into the operator environment or overwrite expected workspace artifacts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Remote command execution is exposed without any warning, disclosure, or confirmation barrier. Given this skill's agent context, a user may not realize that a request can result in arbitrary code running on target devices, making accidental or adversarially induced misuse substantially more dangerous.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The image deletion wrapper enables destructive removal of images without any confirmation or warning. Images can be operationally important assets, so accidental or manipulated deletion can disrupt deployments and recovery workflows.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Unsubscribing host resources is destructive and potentially billing-relevant, yet the wrapper exposes it without a user-facing warning or explicit confirmation gate. In an automation context this increases the chance of unintended deprovisioning or service interruption.

Static analysis

No suspicious patterns detected.