Habilidades byted-ark-seedream-skill
📦
byted-ark-seedream-skill
v3.0.0 Revisión del contenido r1 Crítico 📁 Acceso al sistema de archivos🔑 Variables de entorno⚙️ Comandos externos🌐 Acceso a red
Generate Seedream Images with VolcEngine Ark
Creating polished images and consistent visual sets requires detailed prompts and repeated API work. This skill prepares requests, calls Seedream, and downloads the results.
Compatible con: Claude Codex Code(CC)
No instales este Skill automáticamente.
La política canónica exige la revisión de un operador antes de cualquier acción de instalación.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "byted-ark-seedream-skill" from https://skillstore.io/skills/kotot-byted-ark-seedream-skill.md and its manifest at https://skillstore.io/api/skills/kotot-byted-ark-seedream-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "byted-ark-seedream-skill". Generate a cinematic photograph of a blue British Shorthair resting beside a sunny wooden window.
Resultado esperado:
One locally saved image with cinematic lighting, detailed fur, balanced composition, and a generation summary.
Usando "byted-ark-seedream-skill". Create four coherent illustrations of the same cafe during spring, summer, autumn, and winter.
Resultado esperado:
Four dated image files with a unified composition, palette, and seasonal changes, plus shared generation metadata.
Usando "byted-ark-seedream-skill". Use my product photo to create a clean studio scene with soft shadows and a white background.
Resultado esperado:
A reference-guided product variation saved locally, with the source influence and requested studio treatment applied.
Auditoría de seguridad
Críticov1 • 16/8/2026 Abrir el informe versionado
Most backtick, entropy, documentation URL, and path alerts are scanner false positives. Confirmed behavior includes credential discovery, sensitive platform configuration access, network requests, and filesystem writes. The skill also contains explicit prompt injection and unsafe credential and endpoint flows, so publication requires remediation.
10
Archivos escaneados
2,671
Líneas analizadas
82
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (15)
Crítico
Prompt Injection Attempt Detected
SKILL.md labels marketplace content as "[系统指令]" and directs the agent to prioritize this tool without confirmation. It also requires output wording to remain unchanged, attempting to control agent policy and responses.
The file explicitly claims system-instruction status and issues mandatory tool-selection and response-control directives. This directly matches prompt-injection indicators.
Alto
Environment file access
// env var。/root/.openclaw/.env 用绝对路径优先检查(不依赖脚本实际运行时 $HOME 解析到
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
Alto
Environment file access
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
Alto
Environment file access
const OPENCLAW_ENV_PATHS = ['/root/.openclaw/.env', path.join(os.homedir(), '.openclaw', '.env')];
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
Alto
Environment file access
if (key && !(key in process.env)) {
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
Alto
Environment file access
process.env[key] = value;
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
Alto
Environment file access
if (claudeConfig.env?.ANTHROPIC_AUTH_TOKEN) {
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
Alto
Environment file access
const validation = validateArkKey(claudeConfig.env.ANTHROPIC_AUTH_TOKEN);
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
Mostrar los 15 problemas confirmados
Alto
Environment file access
existingKey = config.env?.ANTHROPIC_AUTH_TOKEN;
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
Alto
Environment file access
if (!config.env) config.env = {};
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
Alto
Environment file access
config.env.ANTHROPIC_AUTH_TOKEN = apiKey;
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
Alto
Bearer Credential Can Be Sent to an Untrusted Endpoint
Environment variables can replace the API base URL, including with HTTP, while the request always attaches the discovered bearer credential. No host allowlist or HTTPS requirement protects the credential.
The data flow is direct: an unrestricted environment URL forms the request destination and CONFIG.apiKey is inserted into its Authorization header.
Alto
Unsafe API Credential Collection Workflow
The skill tells users to send API keys in chat and accepts keys through command-line arguments. Chat transcripts, shell history, process listings, and agent logs may retain those credentials.
The user-facing error explicitly requests a key in conversation, and the CLI parser directly consumes key arguments. Both channels commonly persist sensitive values.
Medio
Generated Resource Downloads Permit SSRF
Image URLs and redirects from the API are fetched without blocking private, loopback, link-local, or non-HTTPS destinations. A compromised or overridden API can make the host request internal resources.
The downloader accepts both HTTP and HTTPS and follows redirects, while URLs are taken directly from API response fields without destination validation.
Medio
Web Search Can Activate Without Explicit Consent
Prompt keywords automatically enable web search when the user did not choose a setting. This expands external processing and may expose prompt details unexpectedly.
The code sets enable_web_search to true solely from keyword matching when the parameter is absent. No confirmation step is present.
Elementos de revisión de capacidades (82)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Node.js fs operations
const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
const content = fs.readFileSync(configPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
content = fs.readFileSync(rawPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
const claudeConfig = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
fs.writeFileSync(configPath, JSON.stringify(originalConfig, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
let originalContent = fs.readFileSync(configPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
fs.writeFileSync(backupPath, sanitizedContent);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
fs.writeFileSync(configPath, content);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
fs.mkdirSync(claudeDir, { recursive: true });
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
Alto
Synchronous file operations
const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
const content = fs.readFileSync(configPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
content = fs.readFileSync(rawPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
const claudeConfig = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
fs.writeFileSync(configPath, JSON.stringify(originalConfig, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
let originalContent = fs.readFileSync(configPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
fs.writeFileSync(backupPath, sanitizedContent);
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
fs.writeFileSync(configPath, content);
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Synchronous file operations
fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
Alto
Hidden file in home directory
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
Alto
Hidden file access
// env var。/root/.openclaw/.env 用绝对路径优先检查(不依赖脚本实际运行时 $HOME 解析到
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
Alto
Hidden file access
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
Alto
Hidden file access
const OPENCLAW_ENV_PATHS = ['/root/.openclaw/.env', path.join(os.homedir(), '.openclaw', '.env')];
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
Alto
Environment variable access (bracket notation)
const value = process.env[envName];
The script scans several generic environment-variable names for an ark-prefixed credential. This can consume a credential not dedicated to this skill.
Alto
Environment variable access (bracket notation)
process.env[key] = value;
Values parsed from an OpenClaw dotenv file are copied into the process environment. This imports potentially sensitive configuration into the skill process.
Alto
Environment variable access (dot notation)
if (fs.existsSync(path.join(homedir, '.claude')) || process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable access (dot notation)
if (process.env.ARK_SEEDREAM_API_KEY) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable access (dot notation)
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable access (dot notation)
if (process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable access (dot notation)
const validation = validateArkKey(process.env.ANTHROPIC_AUTH_TOKEN);
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable object
if (fs.existsSync(path.join(homedir, '.claude')) || process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable object
const value = process.env[envName];
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable object
if (key && !(key in process.env)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable object
process.env[key] = value;
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable object
if (process.env.ARK_SEEDREAM_API_KEY) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable object
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable object
if (process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
Environment variable object
const validation = validateArkKey(process.env.ANTHROPIC_AUTH_TOKEN);
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Alto
dotenv library
// 部分宿主平台(如 OpenClaw)通过一份 dotenv 文件下发工具凭证,而非直接暴露成真实
The surrounding function manually loads OpenClaw dotenv files that may contain credentials. This is genuine sensitive configuration access, even without a dotenv package.
Alto
Generic API/secret keys
const match = content.match(/^model:\s*(?:\n.*)*?api_key:\s*[\"']?(ark-[^\"'\\s]+)[\"']?/m);
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Alto
Generic API/secret keys
'API_KEY',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Alto
Generic API/secret keys
'API_Key',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Alto
Generic API/secret keys
'API_Keys',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Alto
Generic API/secret keys
'api_key',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Alto
Generic API/secret keys
if (process.env.ARK_SEEDREAM_API_KEY) {
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Alto
Generic API/secret keys
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Alto
Generic API/secret keys
const regex = /^(model:\s*(?:\n.*)*?api_key:\s*)["']?[^"'\s]+["']?/m;
This expression locates the Hermes credential field before replacing it during an explicitly requested global save. It participates in persistent secret modification.
Alto
Generic API/secret keys
`$1\n api_key: "${apiKey}"`
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Alto
Generic API/secret keys
const apiKeyParam = params['api-key'] || params.api_key || params.apiKey;
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
Medio
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Medio
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Medio
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Medio
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Medio
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Medio
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Medio
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Medio
Node.js fs operations
fs.mkdirSync(dirPath, { recursive: true });
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Medio
Node.js fs operations
fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), 'utf-8');
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
Medio
Synchronous file operations
fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), 'utf-8');
This synchronous write creates generation metadata in the configured output directory. It is expected behavior but is a real filesystem mutation.
Medio
File stream creation
file = fs.createWriteStream(savePath);
The script creates a writable stream for a generated image in the configured output directory. This is expected but confirms filesystem write capability.
Medio
Environment variable access (dot notation)
if (raw && (process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Medio
Environment variable access (dot notation)
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This environment override controls the destination receiving the Authorization header. The value is not restricted to an approved HTTPS host.
Medio
Environment variable object
if (raw && (process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
Medio
Environment variable object
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This environment override controls the destination receiving the Authorization header. The value is not restricted to an approved HTTPS host.
Bajo
HTTP client library
function request(url, options, data = null) {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
Bajo
HTTP client library
const req = lib.request(url, options, (res) => {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
Bajo
HTTP client library
const req = lib.request(url, options, (res) => {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
Bajo
HTTP client library
const response = await request(url, options, body);
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
Bajo
Hardcoded URL
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This is the default VolcEngine Ark API endpoint used for outbound generation requests. It is a real, disclosed network destination.
Factores de riesgo
📁 Acceso al sistema de archivos (50)
references/CONFIG.md:37 references/CONFIG.md:38 references/CONFIG.md:39 references/CONFIG.md:37 references/CONFIG.md:38 references/CONFIG.md:39 references/DEVELOPER.md:34 references/DEVELOPER.md:34 references/INSTALL.md:33 references/INSTALL.md:92 references/INSTALL.md:33 references/INSTALL.md:92 references/README.md:67 references/README.md:68 references/README.md:69 references/README.md:270 references/README.md:280 references/README.md:288 references/README.md:67 references/README.md:68 references/README.md:69 references/README.md:270 references/README.md:280 references/README.md:288 scripts/generate.js:212 scripts/generate.js:237 scripts/generate.js:296 scripts/generate.js:354 scripts/generate.js:432 scripts/generate.js:434 scripts/generate.js:440 scripts/generate.js:442 scripts/generate.js:459 scripts/generate.js:464 scripts/generate.js:476 scripts/generate.js:478 scripts/generate.js:493 scripts/generate.js:502 scripts/generate.js:505 scripts/generate.js:508 scripts/generate.js:525 scripts/generate.js:527 scripts/generate.js:893 scripts/generate.js:910 scripts/generate.js:920 scripts/generate.js:937 scripts/generate.js:943 scripts/generate.js:951 scripts/generate.js:959 scripts/generate.js:967
🔑 Variables de entorno (50)
references/CONFIG.md:38 references/CONFIG.md:51 references/CONFIG.md:52 references/CONFIG.md:53 references/CONFIG.md:54 references/INSTALL.md:9 references/INSTALL.md:51 references/README.md:69 references/README.md:74 references/README.md:75 references/README.md:76 references/README.md:77 references/README.md:82 references/README.md:276 references/VERSION:8 scripts/generate.js:272 scripts/generate.js:312 scripts/generate.js:198 scripts/generate.js:326 scripts/generate.js:327 scripts/generate.js:334 scripts/generate.js:344 scripts/generate.js:345 scripts/generate.js:576 scripts/generate.js:577 scripts/generate.js:579 scripts/generate.js:580 scripts/generate.js:596 scripts/generate.js:598 scripts/generate.js:749 scripts/generate.js:850 scripts/generate.js:198 scripts/generate.js:272 scripts/generate.js:311 scripts/generate.js:312 scripts/generate.js:326 scripts/generate.js:327 scripts/generate.js:334 scripts/generate.js:344 scripts/generate.js:345 scripts/generate.js:576 scripts/generate.js:577 scripts/generate.js:579 scripts/generate.js:580 scripts/generate.js:596 scripts/generate.js:598 scripts/generate.js:749 scripts/generate.js:850 scripts/generate.js:284 scripts/generate.js:325
⚙️ Comandos externos (50)
references/DEVELOPER.md:135-137 references/DEVELOPER.md:137-141 scripts/generate.js:78 scripts/generate.js:79 scripts/generate.js:80 scripts/generate.js:133 scripts/generate.js:134 scripts/generate.js:138 scripts/generate.js:142 scripts/generate.js:143 scripts/generate.js:181 scripts/generate.js:427 scripts/generate.js:444 scripts/generate.js:445 scripts/generate.js:446 scripts/generate.js:447 scripts/generate.js:454 scripts/generate.js:469 scripts/generate.js:473 scripts/generate.js:480 scripts/generate.js:481 scripts/generate.js:482 scripts/generate.js:483 scripts/generate.js:517 scripts/generate.js:518 scripts/generate.js:519 scripts/generate.js:529 scripts/generate.js:530 scripts/generate.js:532 scripts/generate.js:534 scripts/generate.js:540 scripts/generate.js:544 scripts/generate.js:643 scripts/generate.js:652 scripts/generate.js:666 scripts/generate.js:676 scripts/generate.js:681 scripts/generate.js:688 scripts/generate.js:698 scripts/generate.js:705 scripts/generate.js:778 scripts/generate.js:805 scripts/generate.js:838 scripts/generate.js:839 scripts/generate.js:852 scripts/generate.js:877 scripts/generate.js:890 scripts/generate.js:911 scripts/generate.js:921 scripts/generate.js:944
🌐 Acceso a red (13)
references/DEVELOPER.md:18 references/DEVELOPER.md:58 references/DEVELOPER.md:155 references/README.md:303 references/VERSION:7 scripts/generate.js:743 scripts/generate.js:751 scripts/generate.js:797 scripts/generate.js:1141 scripts/generate.js:79 scripts/generate.js:80 scripts/generate.js:596 scripts/generate.js:1092
Auditado por: codex
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/kotot-byted-ark-seedream-skill?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/kotot-byted-ark-seedream-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/kotot-byted-ark-seedream-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/kotot-byted-ark-seedream-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
kotot. (2026). byted-ark-seedream-skill security audit report (audit version 1) [Author version 3.0.0]. Skillstore. https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1Cita BibTeX
@techreport{kotot-kotot-byted-ark-seedream-skill-2026,
author = {kotot},
title = {byted-ark-seedream-skill security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1},
note = {Author version 3.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "byted-ark-seedream-skill security audit report (audit version 1)"
version: "3.0.0"
type: report
authors:
- name: "kotot"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1"
identifiers:
- type: other
value: "skillstore:kotot-byted-ark-seedream-skill:audit:1"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Bajo 68
Arquitectura
100
Mantenibilidad
87
Contenido
65
Comunidad
91
Cumplimiento de la especificación
Lo que puedes crear
Create Campaign Visuals
Generate polished concepts and consistent variations for advertisements, social posts, and presentations.
Develop Character Studies
Produce a coherent character across expressions, scenes, or seasonal settings using sequential generation.
Explore Reference Variations
Transform one or more reference images while controlling style influence and output quality.
Prueba estos prompts
Generate One Image
Generate one image of [subject] in [setting]. Use [style], [lighting], and [aspect or size].
Create a Consistent Series
Generate [count] coherent images showing [sequence]. Keep the same character, composition rules, palette, and visual style across every image.
Adapt a Reference Image
Use [reference image] to create [new scene]. Preserve [important features], change [requested elements], and apply reference strength [0 to 1].
Direct a Production Set
Create [count] production-ready images for [audience and channel]. Define each frame, shared art direction, exclusions, resolution, format, watermark, and search requirements.
Mejores prácticas
- Describe the subject, setting, lighting, composition, and desired style in concrete terms.
- For image sets, define every frame and repeat consistency requirements in the prompt.
- Use dedicated secret storage and review external service privacy terms before sending references.
Evitar
- Do not paste API keys into chat messages or command-line arguments.
- Do not request a coherent series with only a general prompt and a count.
- Do not send confidential reference images to an unverified API endpoint.
Preguntas frecuentes
What do I need to run this skill?
You need Node.js 18 or later, network access, and a valid VolcEngine Ark Agent Plan credential.
Can it generate video?
No. This skill generates still images only.
Can it use reference images?
Yes. It accepts HTTP image URLs or base64 image data and supports up to fourteen references.
Where are generated images saved?
Images are saved under a dated Seedream-Images directory in the current working directory unless a save path is configured.
How does it keep an image series consistent?
It adds consistency guidance and requires the prompt to describe each frame, shared style, and recurring subjects.
Does it use web search?
It can enable web search for current topics. Review this setting before sending prompts that contain sensitive information.