Volcengine VeADK Skills

• Analyzed: May 12, 2026, 3:43 AM
• Findings: 1
• Version: 1.0.0
• Hash: f003e89a0b4387c0c4f30f0ea2e842d7cae0609b5e58e804335b1316af18d8f5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is suspicious due to high-risk capabilities that enable prompt injection for arbitrary file write and code execution. The `SKILL.md` instructs the AI agent to use `scripts/save_file.py` with agent-determined paths and content, and `save_file.py` performs no path validation, allowing arbitrary file writes. Additionally, `references/common/tools.md` and `references/converter/dify_rules.md` explicitly instruct the agent to use a `run_code` tool for executing Python code, which, without strong sandboxing, poses a significant risk for arbitrary code execution via prompt injection.