Fähigkeiten byted-ark-seedream-skill
📦
byted-ark-seedream-skill
v3.0.0 Inhaltsrevision r1 Kritisch 📁 Dateisystemzugriff🔑 Umgebungsvariablen⚙️ Externe Befehle🌐 Netzwerkzugriff
Generate Seedream Images with VolcEngine Ark
Creating polished images and consistent visual sets requires detailed prompts and repeated API work. This skill prepares requests, calls Seedream, and downloads the results.
Unterstützt: Claude Codex Code(CC)
Diesen Skill nicht automatisch installieren.
Die maßgebliche Richtlinie verlangt vor jeder Installationsaktion eine Prüfung durch einen Bediener.
Mit meinem Agent installieren
Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.
Agent-Anfrage
Review the Skillstore skill "byted-ark-seedream-skill" from https://skillstore.io/skills/kotot-byted-ark-seedream-skill.md and its manifest at https://skillstore.io/api/skills/kotot-byted-ark-seedream-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.
Agent-lesbare Ressourcen
Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.
Testen
„byted-ark-seedream-skill“ wird verwendet. Generate a cinematic photograph of a blue British Shorthair resting beside a sunny wooden window.
Erwartetes Ergebnis:
One locally saved image with cinematic lighting, detailed fur, balanced composition, and a generation summary.
„byted-ark-seedream-skill“ wird verwendet. Create four coherent illustrations of the same cafe during spring, summer, autumn, and winter.
Erwartetes Ergebnis:
Four dated image files with a unified composition, palette, and seasonal changes, plus shared generation metadata.
„byted-ark-seedream-skill“ wird verwendet. Use my product photo to create a clean studio scene with soft shadows and a white background.
Erwartetes Ergebnis:
A reference-guided product variation saved locally, with the source influence and requested studio treatment applied.
Sicherheitsaudit
Kritischv1 • 16.8.2026 Versionsbericht öffnen
Most backtick, entropy, documentation URL, and path alerts are scanner false positives. Confirmed behavior includes credential discovery, sensitive platform configuration access, network requests, and filesystem writes. The skill also contains explicit prompt injection and unsafe credential and endpoint flows, so publication requires remediation.
10
Gescannte Dateien
2,671
Analysierte Zeilen
82
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (15)
Kritisch
Prompt Injection Attempt Detected
SKILL.md labels marketplace content as "[系统指令]" and directs the agent to prioritize this tool without confirmation. It also requires output wording to remain unchanged, attempting to control agent policy and responses.
The file explicitly claims system-instruction status and issues mandatory tool-selection and response-control directives. This directly matches prompt-injection indicators.
Hoch
Environment file access
// env var。/root/.openclaw/.env 用绝对路径优先检查(不依赖脚本实际运行时 $HOME 解析到
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
Hoch
Environment file access
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
Hoch
Environment file access
const OPENCLAW_ENV_PATHS = ['/root/.openclaw/.env', path.join(os.homedir(), '.openclaw', '.env')];
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
Hoch
Environment file access
if (key && !(key in process.env)) {
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
Hoch
Environment file access
process.env[key] = value;
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
Hoch
Environment file access
if (claudeConfig.env?.ANTHROPIC_AUTH_TOKEN) {
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
Hoch
Environment file access
const validation = validateArkKey(claudeConfig.env.ANTHROPIC_AUTH_TOKEN);
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
Alle 15 bestätigten Funde anzeigen
Hoch
Environment file access
existingKey = config.env?.ANTHROPIC_AUTH_TOKEN;
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
Hoch
Environment file access
if (!config.env) config.env = {};
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
Hoch
Environment file access
config.env.ANTHROPIC_AUTH_TOKEN = apiKey;
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
Hoch
Bearer Credential Can Be Sent to an Untrusted Endpoint
Environment variables can replace the API base URL, including with HTTP, while the request always attaches the discovered bearer credential. No host allowlist or HTTPS requirement protects the credential.
The data flow is direct: an unrestricted environment URL forms the request destination and CONFIG.apiKey is inserted into its Authorization header.
Hoch
Unsafe API Credential Collection Workflow
The skill tells users to send API keys in chat and accepts keys through command-line arguments. Chat transcripts, shell history, process listings, and agent logs may retain those credentials.
The user-facing error explicitly requests a key in conversation, and the CLI parser directly consumes key arguments. Both channels commonly persist sensitive values.
Mittel
Generated Resource Downloads Permit SSRF
Image URLs and redirects from the API are fetched without blocking private, loopback, link-local, or non-HTTPS destinations. A compromised or overridden API can make the host request internal resources.
The downloader accepts both HTTP and HTTPS and follows redirects, while URLs are taken directly from API response fields without destination validation.
Mittel
Web Search Can Activate Without Explicit Consent
Prompt keywords automatically enable web search when the user did not choose a setting. This expands external processing and may expose prompt details unexpectedly.
The code sets enable_web_search to true solely from keyword matching when the parameter is absent. No confirmation step is present.
Elemente der Fähigkeitsprüfung (82)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Hoch
Node.js fs operations
const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
const content = fs.readFileSync(configPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
content = fs.readFileSync(rawPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
const claudeConfig = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
fs.writeFileSync(configPath, JSON.stringify(originalConfig, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
let originalContent = fs.readFileSync(configPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
fs.writeFileSync(backupPath, sanitizedContent);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
fs.writeFileSync(configPath, content);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
fs.mkdirSync(claudeDir, { recursive: true });
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Hoch
Synchronous file operations
const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
const content = fs.readFileSync(configPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
content = fs.readFileSync(rawPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
const claudeConfig = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
fs.writeFileSync(configPath, JSON.stringify(originalConfig, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
let originalContent = fs.readFileSync(configPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
fs.writeFileSync(backupPath, sanitizedContent);
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
fs.writeFileSync(configPath, content);
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Synchronous file operations
fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Hoch
Hidden file in home directory
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
Hoch
Hidden file access
// env var。/root/.openclaw/.env 用绝对路径优先检查(不依赖脚本实际运行时 $HOME 解析到
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
Hoch
Hidden file access
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
Hoch
Hidden file access
const OPENCLAW_ENV_PATHS = ['/root/.openclaw/.env', path.join(os.homedir(), '.openclaw', '.env')];
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
Hoch
Environment variable access (bracket notation)
const value = process.env[envName];
The script scans several generic environment-variable names for an ark-prefixed credential. This can consume a credential not dedicated to this skill.
Hoch
Environment variable access (bracket notation)
process.env[key] = value;
Values parsed from an OpenClaw dotenv file are copied into the process environment. This imports potentially sensitive configuration into the skill process.
Hoch
Environment variable access (dot notation)
if (fs.existsSync(path.join(homedir, '.claude')) || process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable access (dot notation)
if (process.env.ARK_SEEDREAM_API_KEY) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable access (dot notation)
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable access (dot notation)
if (process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable access (dot notation)
const validation = validateArkKey(process.env.ANTHROPIC_AUTH_TOKEN);
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable object
if (fs.existsSync(path.join(homedir, '.claude')) || process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable object
const value = process.env[envName];
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable object
if (key && !(key in process.env)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable object
process.env[key] = value;
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable object
if (process.env.ARK_SEEDREAM_API_KEY) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable object
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable object
if (process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
Environment variable object
const validation = validateArkKey(process.env.ANTHROPIC_AUTH_TOKEN);
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Hoch
dotenv library
// 部分宿主平台(如 OpenClaw)通过一份 dotenv 文件下发工具凭证,而非直接暴露成真实
The surrounding function manually loads OpenClaw dotenv files that may contain credentials. This is genuine sensitive configuration access, even without a dotenv package.
Hoch
Generic API/secret keys
const match = content.match(/^model:\s*(?:\n.*)*?api_key:\s*[\"']?(ark-[^\"'\\s]+)[\"']?/m);
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Hoch
Generic API/secret keys
'API_KEY',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Hoch
Generic API/secret keys
'API_Key',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Hoch
Generic API/secret keys
'API_Keys',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Hoch
Generic API/secret keys
'api_key',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Hoch
Generic API/secret keys
if (process.env.ARK_SEEDREAM_API_KEY) {
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Hoch
Generic API/secret keys
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Hoch
Generic API/secret keys
const regex = /^(model:\s*(?:\n.*)*?api_key:\s*)["']?[^"'\s]+["']?/m;
This expression locates the Hermes credential field before replacing it during an explicitly requested global save. It participates in persistent secret modification.
Hoch
Generic API/secret keys
`$1\n api_key: "${apiKey}"`
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Hoch
Generic API/secret keys
const apiKeyParam = params['api-key'] || params.api_key || params.apiKey;
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Mittel
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Mittel
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Mittel
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Mittel
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Mittel
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Mittel
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Mittel
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Mittel
Node.js fs operations
fs.mkdirSync(dirPath, { recursive: true });
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Mittel
Node.js fs operations
fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), 'utf-8');
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Mittel
Synchronous file operations
fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), 'utf-8');
This synchronous write creates generation metadata in the configured output directory. It is expected behavior but is a real filesystem mutation.
Mittel
File stream creation
file = fs.createWriteStream(savePath);
The script creates a writable stream for a generated image in the configured output directory. This is expected but confirms filesystem write capability.
Mittel
Environment variable access (dot notation)
if (raw && (process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Mittel
Environment variable access (dot notation)
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This environment override controls the destination receiving the Authorization header. The value is not restricted to an approved HTTPS host.
Mittel
Environment variable object
if (raw && (process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Mittel
Environment variable object
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This environment override controls the destination receiving the Authorization header. The value is not restricted to an approved HTTPS host.
Niedrig
HTTP client library
function request(url, options, data = null) {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
Niedrig
HTTP client library
const req = lib.request(url, options, (res) => {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
Niedrig
HTTP client library
const req = lib.request(url, options, (res) => {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
Niedrig
HTTP client library
const response = await request(url, options, body);
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
Niedrig
Hardcoded URL
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This is the default VolcEngine Ark API endpoint used for outbound generation requests. It is a real, disclosed network destination.
Risikofaktoren
📁 Dateisystemzugriff (50)
references/CONFIG.md:37 references/CONFIG.md:38 references/CONFIG.md:39 references/CONFIG.md:37 references/CONFIG.md:38 references/CONFIG.md:39 references/DEVELOPER.md:34 references/DEVELOPER.md:34 references/INSTALL.md:33 references/INSTALL.md:92 references/INSTALL.md:33 references/INSTALL.md:92 references/README.md:67 references/README.md:68 references/README.md:69 references/README.md:270 references/README.md:280 references/README.md:288 references/README.md:67 references/README.md:68 references/README.md:69 references/README.md:270 references/README.md:280 references/README.md:288 scripts/generate.js:212 scripts/generate.js:237 scripts/generate.js:296 scripts/generate.js:354 scripts/generate.js:432 scripts/generate.js:434 scripts/generate.js:440 scripts/generate.js:442 scripts/generate.js:459 scripts/generate.js:464 scripts/generate.js:476 scripts/generate.js:478 scripts/generate.js:493 scripts/generate.js:502 scripts/generate.js:505 scripts/generate.js:508 scripts/generate.js:525 scripts/generate.js:527 scripts/generate.js:893 scripts/generate.js:910 scripts/generate.js:920 scripts/generate.js:937 scripts/generate.js:943 scripts/generate.js:951 scripts/generate.js:959 scripts/generate.js:967
🔑 Umgebungsvariablen (50)
references/CONFIG.md:38 references/CONFIG.md:51 references/CONFIG.md:52 references/CONFIG.md:53 references/CONFIG.md:54 references/INSTALL.md:9 references/INSTALL.md:51 references/README.md:69 references/README.md:74 references/README.md:75 references/README.md:76 references/README.md:77 references/README.md:82 references/README.md:276 references/VERSION:8 scripts/generate.js:272 scripts/generate.js:312 scripts/generate.js:198 scripts/generate.js:326 scripts/generate.js:327 scripts/generate.js:334 scripts/generate.js:344 scripts/generate.js:345 scripts/generate.js:576 scripts/generate.js:577 scripts/generate.js:579 scripts/generate.js:580 scripts/generate.js:596 scripts/generate.js:598 scripts/generate.js:749 scripts/generate.js:850 scripts/generate.js:198 scripts/generate.js:272 scripts/generate.js:311 scripts/generate.js:312 scripts/generate.js:326 scripts/generate.js:327 scripts/generate.js:334 scripts/generate.js:344 scripts/generate.js:345 scripts/generate.js:576 scripts/generate.js:577 scripts/generate.js:579 scripts/generate.js:580 scripts/generate.js:596 scripts/generate.js:598 scripts/generate.js:749 scripts/generate.js:850 scripts/generate.js:284 scripts/generate.js:325
⚙️ Externe Befehle (50)
references/DEVELOPER.md:135-137 references/DEVELOPER.md:137-141 scripts/generate.js:78 scripts/generate.js:79 scripts/generate.js:80 scripts/generate.js:133 scripts/generate.js:134 scripts/generate.js:138 scripts/generate.js:142 scripts/generate.js:143 scripts/generate.js:181 scripts/generate.js:427 scripts/generate.js:444 scripts/generate.js:445 scripts/generate.js:446 scripts/generate.js:447 scripts/generate.js:454 scripts/generate.js:469 scripts/generate.js:473 scripts/generate.js:480 scripts/generate.js:481 scripts/generate.js:482 scripts/generate.js:483 scripts/generate.js:517 scripts/generate.js:518 scripts/generate.js:519 scripts/generate.js:529 scripts/generate.js:530 scripts/generate.js:532 scripts/generate.js:534 scripts/generate.js:540 scripts/generate.js:544 scripts/generate.js:643 scripts/generate.js:652 scripts/generate.js:666 scripts/generate.js:676 scripts/generate.js:681 scripts/generate.js:688 scripts/generate.js:698 scripts/generate.js:705 scripts/generate.js:778 scripts/generate.js:805 scripts/generate.js:838 scripts/generate.js:839 scripts/generate.js:852 scripts/generate.js:877 scripts/generate.js:890 scripts/generate.js:911 scripts/generate.js:921 scripts/generate.js:944
🌐 Netzwerkzugriff (13)
references/DEVELOPER.md:18 references/DEVELOPER.md:58 references/DEVELOPER.md:155 references/README.md:303 references/VERSION:7 scripts/generate.js:743 scripts/generate.js:751 scripts/generate.js:797 scripts/generate.js:1141 scripts/generate.js:79 scripts/generate.js:80 scripts/generate.js:596 scripts/generate.js:1092
Geprüft von: codex
Diesen Bericht teilen & zitieren
Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.
Berichtslink kopieren
https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown-Badge
[](https://skillstore.io/skills/kotot-byted-ark-seedream-skill?utm_source=security_passport_badge)HTML-Badge
<a href="https://skillstore.io/skills/kotot-byted-ark-seedream-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/kotot-byted-ark-seedream-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Einbettungskarte
<iframe src="https://skillstore.io/embed/skills/kotot-byted-ark-seedream-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Wissenschaftliche Zitate (APA · BibTeX · CFF)
APA-Zitat
kotot. (2026). byted-ark-seedream-skill security audit report (audit version 1) [Author version 3.0.0]. Skillstore. https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1BibTeX-Zitat
@techreport{kotot-kotot-byted-ark-seedream-skill-2026,
author = {kotot},
title = {byted-ark-seedream-skill security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1},
note = {Author version 3.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "byted-ark-seedream-skill security audit report (audit version 1)"
version: "3.0.0"
type: report
authors:
- name: "kotot"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1"
identifiers:
- type: other
value: "skillstore:kotot-byted-ark-seedream-skill:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore-Score
Warum dieser Score Evidenzvertrauen: Niedrig 68
Architektur
100
Wartbarkeit
87
Inhalt
65
Gemeinschaft
91
Spezifikationskonformität
Was Sie erstellen können
Create Campaign Visuals
Generate polished concepts and consistent variations for advertisements, social posts, and presentations.
Develop Character Studies
Produce a coherent character across expressions, scenes, or seasonal settings using sequential generation.
Explore Reference Variations
Transform one or more reference images while controlling style influence and output quality.
Diese Prompts ausprobieren
Generate One Image
Generate one image of [subject] in [setting]. Use [style], [lighting], and [aspect or size].
Create a Consistent Series
Generate [count] coherent images showing [sequence]. Keep the same character, composition rules, palette, and visual style across every image.
Adapt a Reference Image
Use [reference image] to create [new scene]. Preserve [important features], change [requested elements], and apply reference strength [0 to 1].
Direct a Production Set
Create [count] production-ready images for [audience and channel]. Define each frame, shared art direction, exclusions, resolution, format, watermark, and search requirements.
Bewährte Praktiken
- Describe the subject, setting, lighting, composition, and desired style in concrete terms.
- For image sets, define every frame and repeat consistency requirements in the prompt.
- Use dedicated secret storage and review external service privacy terms before sending references.
Vermeiden
- Do not paste API keys into chat messages or command-line arguments.
- Do not request a coherent series with only a general prompt and a count.
- Do not send confidential reference images to an unverified API endpoint.
Häufig gestellte Fragen
What do I need to run this skill?
You need Node.js 18 or later, network access, and a valid VolcEngine Ark Agent Plan credential.
Can it generate video?
No. This skill generates still images only.
Can it use reference images?
Yes. It accepts HTTP image URLs or base64 image data and supports up to fourteen references.
Where are generated images saved?
Images are saved under a dated Seedream-Images directory in the current working directory unless a save path is configured.
How does it keep an image series consistent?
It adds consistency guidance and requires the prompt to describe each frame, shared style, and recurring subjects.
Does it use web search?
It can enable web search for current topics. Review this setting before sending prompts that contain sensitive information.