スキル byted-ark-seedream-skill
📦
byted-ark-seedream-skill
v3.0.0 コンテンツリビジョン r1 重大 📁 ファイルシステムへのアクセス🔑 環境変数⚙️ 外部コマンド🌐 ネットワークアクセス
Generate Seedream Images with VolcEngine Ark
Creating polished images and consistent visual sets requires detailed prompts and repeated API work. This skill prepares requests, calls Seedream, and downloads the results.
対応: Claude Codex Code(CC)
この Skill を自動インストールしないでください。
基準ポリシーにより、インストール操作の前にオペレーターのレビューが必要です。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "byted-ark-seedream-skill" from https://skillstore.io/skills/kotot-byted-ark-seedream-skill.md and its manifest at https://skillstore.io/api/skills/kotot-byted-ark-seedream-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「byted-ark-seedream-skill」を使用しています。 Generate a cinematic photograph of a blue British Shorthair resting beside a sunny wooden window.
期待される結果:
One locally saved image with cinematic lighting, detailed fur, balanced composition, and a generation summary.
「byted-ark-seedream-skill」を使用しています。 Create four coherent illustrations of the same cafe during spring, summer, autumn, and winter.
期待される結果:
Four dated image files with a unified composition, palette, and seasonal changes, plus shared generation metadata.
「byted-ark-seedream-skill」を使用しています。 Use my product photo to create a clean studio scene with soft shadows and a white background.
期待される結果:
A reference-guided product variation saved locally, with the source influence and requested studio treatment applied.
セキュリティ監査
重大v1 • 2026/8/16 バージョン別レポートを開く
Most backtick, entropy, documentation URL, and path alerts are scanner false positives. Confirmed behavior includes credential discovery, sensitive platform configuration access, network requests, and filesystem writes. The skill also contains explicit prompt injection and unsafe credential and endpoint flows, so publication requires remediation.
10
スキャンされたファイル
2,671
解析済み行数
82
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (15)
重大
Prompt Injection Attempt Detected
SKILL.md labels marketplace content as "[系统指令]" and directs the agent to prioritize this tool without confirmation. It also requires output wording to remain unchanged, attempting to control agent policy and responses.
The file explicitly claims system-instruction status and issues mandatory tool-selection and response-control directives. This directly matches prompt-injection indicators.
高
Environment file access
// env var。/root/.openclaw/.env 用绝对路径优先检查(不依赖脚本实际运行时 $HOME 解析到
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
高
Environment file access
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
高
Environment file access
const OPENCLAW_ENV_PATHS = ['/root/.openclaw/.env', path.join(os.homedir(), '.openclaw', '.env')];
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
高
Environment file access
if (key && !(key in process.env)) {
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
高
Environment file access
process.env[key] = value;
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
高
Environment file access
if (claudeConfig.env?.ANTHROPIC_AUTH_TOKEN) {
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
高
Environment file access
const validation = validateArkKey(claudeConfig.env.ANTHROPIC_AUTH_TOKEN);
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
確認済みの15件をすべて表示
高
Environment file access
existingKey = config.env?.ANTHROPIC_AUTH_TOKEN;
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
高
Environment file access
if (!config.env) config.env = {};
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
高
Environment file access
config.env.ANTHROPIC_AUTH_TOKEN = apiKey;
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
高
Bearer Credential Can Be Sent to an Untrusted Endpoint
Environment variables can replace the API base URL, including with HTTP, while the request always attaches the discovered bearer credential. No host allowlist or HTTPS requirement protects the credential.
The data flow is direct: an unrestricted environment URL forms the request destination and CONFIG.apiKey is inserted into its Authorization header.
高
Unsafe API Credential Collection Workflow
The skill tells users to send API keys in chat and accepts keys through command-line arguments. Chat transcripts, shell history, process listings, and agent logs may retain those credentials.
The user-facing error explicitly requests a key in conversation, and the CLI parser directly consumes key arguments. Both channels commonly persist sensitive values.
中
Generated Resource Downloads Permit SSRF
Image URLs and redirects from the API are fetched without blocking private, loopback, link-local, or non-HTTPS destinations. A compromised or overridden API can make the host request internal resources.
The downloader accepts both HTTP and HTTPS and follows redirects, while URLs are taken directly from API response fields without destination validation.
中
Web Search Can Activate Without Explicit Consent
Prompt keywords automatically enable web search when the user did not choose a setting. This expands external processing and may expose prompt details unexpectedly.
The code sets enable_web_search to true solely from keyword matching when the parameter is absent. No confirmation step is present.
機能レビュー項目 (82)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
高
Node.js fs operations
const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
const content = fs.readFileSync(configPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
content = fs.readFileSync(rawPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
const claudeConfig = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(configPath, JSON.stringify(originalConfig, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
let originalContent = fs.readFileSync(configPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(backupPath, sanitizedContent);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(configPath, content);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.mkdirSync(claudeDir, { recursive: true });
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Synchronous file operations
const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
const content = fs.readFileSync(configPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
content = fs.readFileSync(rawPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
const claudeConfig = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(configPath, JSON.stringify(originalConfig, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
let originalContent = fs.readFileSync(configPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(backupPath, sanitizedContent);
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(configPath, content);
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Hidden file in home directory
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
高
Hidden file access
// env var。/root/.openclaw/.env 用绝对路径优先检查(不依赖脚本实际运行时 $HOME 解析到
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
高
Hidden file access
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
高
Hidden file access
const OPENCLAW_ENV_PATHS = ['/root/.openclaw/.env', path.join(os.homedir(), '.openclaw', '.env')];
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
高
Environment variable access (bracket notation)
const value = process.env[envName];
The script scans several generic environment-variable names for an ark-prefixed credential. This can consume a credential not dedicated to this skill.
高
Environment variable access (bracket notation)
process.env[key] = value;
Values parsed from an OpenClaw dotenv file are copied into the process environment. This imports potentially sensitive configuration into the skill process.
高
Environment variable access (dot notation)
if (fs.existsSync(path.join(homedir, '.claude')) || process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable access (dot notation)
if (process.env.ARK_SEEDREAM_API_KEY) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable access (dot notation)
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable access (dot notation)
if (process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable access (dot notation)
const validation = validateArkKey(process.env.ANTHROPIC_AUTH_TOKEN);
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
if (fs.existsSync(path.join(homedir, '.claude')) || process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
const value = process.env[envName];
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
if (key && !(key in process.env)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
process.env[key] = value;
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
if (process.env.ARK_SEEDREAM_API_KEY) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
if (process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
const validation = validateArkKey(process.env.ANTHROPIC_AUTH_TOKEN);
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
dotenv library
// 部分宿主平台(如 OpenClaw)通过一份 dotenv 文件下发工具凭证,而非直接暴露成真实
The surrounding function manually loads OpenClaw dotenv files that may contain credentials. This is genuine sensitive configuration access, even without a dotenv package.
高
Generic API/secret keys
const match = content.match(/^model:\s*(?:\n.*)*?api_key:\s*[\"']?(ark-[^\"'\\s]+)[\"']?/m);
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
'API_KEY',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
'API_Key',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
'API_Keys',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
'api_key',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
if (process.env.ARK_SEEDREAM_API_KEY) {
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
const regex = /^(model:\s*(?:\n.*)*?api_key:\s*)["']?[^"'\s]+["']?/m;
This expression locates the Hermes credential field before replacing it during an explicitly requested global save. It participates in persistent secret modification.
高
Generic API/secret keys
`$1\n api_key: "${apiKey}"`
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
const apiKeyParam = params['api-key'] || params.api_key || params.apiKey;
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.mkdirSync(dirPath, { recursive: true });
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), 'utf-8');
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Synchronous file operations
fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), 'utf-8');
This synchronous write creates generation metadata in the configured output directory. It is expected behavior but is a real filesystem mutation.
中
File stream creation
file = fs.createWriteStream(savePath);
The script creates a writable stream for a generated image in the configured output directory. This is expected but confirms filesystem write capability.
中
Environment variable access (dot notation)
if (raw && (process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
中
Environment variable access (dot notation)
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This environment override controls the destination receiving the Authorization header. The value is not restricted to an approved HTTPS host.
中
Environment variable object
if (raw && (process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
中
Environment variable object
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This environment override controls the destination receiving the Authorization header. The value is not restricted to an approved HTTPS host.
低
HTTP client library
function request(url, options, data = null) {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
低
HTTP client library
const req = lib.request(url, options, (res) => {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
低
HTTP client library
const req = lib.request(url, options, (res) => {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
低
HTTP client library
const response = await request(url, options, body);
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
低
Hardcoded URL
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This is the default VolcEngine Ark API endpoint used for outbound generation requests. It is a real, disclosed network destination.
リスク要因
📁 ファイルシステムへのアクセス (50)
references/CONFIG.md:37 references/CONFIG.md:38 references/CONFIG.md:39 references/CONFIG.md:37 references/CONFIG.md:38 references/CONFIG.md:39 references/DEVELOPER.md:34 references/DEVELOPER.md:34 references/INSTALL.md:33 references/INSTALL.md:92 references/INSTALL.md:33 references/INSTALL.md:92 references/README.md:67 references/README.md:68 references/README.md:69 references/README.md:270 references/README.md:280 references/README.md:288 references/README.md:67 references/README.md:68 references/README.md:69 references/README.md:270 references/README.md:280 references/README.md:288 scripts/generate.js:212 scripts/generate.js:237 scripts/generate.js:296 scripts/generate.js:354 scripts/generate.js:432 scripts/generate.js:434 scripts/generate.js:440 scripts/generate.js:442 scripts/generate.js:459 scripts/generate.js:464 scripts/generate.js:476 scripts/generate.js:478 scripts/generate.js:493 scripts/generate.js:502 scripts/generate.js:505 scripts/generate.js:508 scripts/generate.js:525 scripts/generate.js:527 scripts/generate.js:893 scripts/generate.js:910 scripts/generate.js:920 scripts/generate.js:937 scripts/generate.js:943 scripts/generate.js:951 scripts/generate.js:959 scripts/generate.js:967
🔑 環境変数 (50)
references/CONFIG.md:38 references/CONFIG.md:51 references/CONFIG.md:52 references/CONFIG.md:53 references/CONFIG.md:54 references/INSTALL.md:9 references/INSTALL.md:51 references/README.md:69 references/README.md:74 references/README.md:75 references/README.md:76 references/README.md:77 references/README.md:82 references/README.md:276 references/VERSION:8 scripts/generate.js:272 scripts/generate.js:312 scripts/generate.js:198 scripts/generate.js:326 scripts/generate.js:327 scripts/generate.js:334 scripts/generate.js:344 scripts/generate.js:345 scripts/generate.js:576 scripts/generate.js:577 scripts/generate.js:579 scripts/generate.js:580 scripts/generate.js:596 scripts/generate.js:598 scripts/generate.js:749 scripts/generate.js:850 scripts/generate.js:198 scripts/generate.js:272 scripts/generate.js:311 scripts/generate.js:312 scripts/generate.js:326 scripts/generate.js:327 scripts/generate.js:334 scripts/generate.js:344 scripts/generate.js:345 scripts/generate.js:576 scripts/generate.js:577 scripts/generate.js:579 scripts/generate.js:580 scripts/generate.js:596 scripts/generate.js:598 scripts/generate.js:749 scripts/generate.js:850 scripts/generate.js:284 scripts/generate.js:325
⚙️ 外部コマンド (50)
references/DEVELOPER.md:135-137 references/DEVELOPER.md:137-141 scripts/generate.js:78 scripts/generate.js:79 scripts/generate.js:80 scripts/generate.js:133 scripts/generate.js:134 scripts/generate.js:138 scripts/generate.js:142 scripts/generate.js:143 scripts/generate.js:181 scripts/generate.js:427 scripts/generate.js:444 scripts/generate.js:445 scripts/generate.js:446 scripts/generate.js:447 scripts/generate.js:454 scripts/generate.js:469 scripts/generate.js:473 scripts/generate.js:480 scripts/generate.js:481 scripts/generate.js:482 scripts/generate.js:483 scripts/generate.js:517 scripts/generate.js:518 scripts/generate.js:519 scripts/generate.js:529 scripts/generate.js:530 scripts/generate.js:532 scripts/generate.js:534 scripts/generate.js:540 scripts/generate.js:544 scripts/generate.js:643 scripts/generate.js:652 scripts/generate.js:666 scripts/generate.js:676 scripts/generate.js:681 scripts/generate.js:688 scripts/generate.js:698 scripts/generate.js:705 scripts/generate.js:778 scripts/generate.js:805 scripts/generate.js:838 scripts/generate.js:839 scripts/generate.js:852 scripts/generate.js:877 scripts/generate.js:890 scripts/generate.js:911 scripts/generate.js:921 scripts/generate.js:944
🌐 ネットワークアクセス (13)
references/DEVELOPER.md:18 references/DEVELOPER.md:58 references/DEVELOPER.md:155 references/README.md:303 references/VERSION:7 scripts/generate.js:743 scripts/generate.js:751 scripts/generate.js:797 scripts/generate.js:1141 scripts/generate.js:79 scripts/generate.js:80 scripts/generate.js:596 scripts/generate.js:1092
監査者: codex
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/kotot-byted-ark-seedream-skill?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/kotot-byted-ark-seedream-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/kotot-byted-ark-seedream-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/kotot-byted-ark-seedream-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
kotot. (2026). byted-ark-seedream-skill security audit report (audit version 1) [Author version 3.0.0]. Skillstore. https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1BibTeX形式の引用
@techreport{kotot-kotot-byted-ark-seedream-skill-2026,
author = {kotot},
title = {byted-ark-seedream-skill security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1},
note = {Author version 3.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "byted-ark-seedream-skill security audit report (audit version 1)"
version: "3.0.0"
type: report
authors:
- name: "kotot"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1"
identifiers:
- type: other
value: "skillstore:kotot-byted-ark-seedream-skill:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 低 68
アーキテクチャ
100
保守性
87
コンテンツ
65
コミュニティ
91
仕様準拠
作成できるもの
Create Campaign Visuals
Generate polished concepts and consistent variations for advertisements, social posts, and presentations.
Develop Character Studies
Produce a coherent character across expressions, scenes, or seasonal settings using sequential generation.
Explore Reference Variations
Transform one or more reference images while controlling style influence and output quality.
これらのプロンプトを試す
Generate One Image
Generate one image of [subject] in [setting]. Use [style], [lighting], and [aspect or size].
Create a Consistent Series
Generate [count] coherent images showing [sequence]. Keep the same character, composition rules, palette, and visual style across every image.
Adapt a Reference Image
Use [reference image] to create [new scene]. Preserve [important features], change [requested elements], and apply reference strength [0 to 1].
Direct a Production Set
Create [count] production-ready images for [audience and channel]. Define each frame, shared art direction, exclusions, resolution, format, watermark, and search requirements.
ベストプラクティス
- Describe the subject, setting, lighting, composition, and desired style in concrete terms.
- For image sets, define every frame and repeat consistency requirements in the prompt.
- Use dedicated secret storage and review external service privacy terms before sending references.
回避
- Do not paste API keys into chat messages or command-line arguments.
- Do not request a coherent series with only a general prompt and a count.
- Do not send confidential reference images to an unverified API endpoint.
よくある質問
What do I need to run this skill?
You need Node.js 18 or later, network access, and a valid VolcEngine Ark Agent Plan credential.
Can it generate video?
No. This skill generates still images only.
Can it use reference images?
Yes. It accepts HTTP image URLs or base64 image data and supports up to fourteen references.
Where are generated images saved?
Images are saved under a dated Seedream-Images directory in the current working directory unless a save path is configured.
How does it keep an image series consistent?
It adds consistency guidance and requires the prompt to describe each frame, shared style, and recurring subjects.
Does it use web search?
It can enable web search for current topics. Review this setting before sending prompts that contain sensitive information.