์คํฌ byted-ark-seedream-skill
๐ฆ
byted-ark-seedream-skill
v3.0.0 ์ฝํ
์ธ ๋ฆฌ๋น์ r1 ์น๋ช
์ ๐ ํ์ผ ์์คํ
์ ๊ทผ๐ ํ๊ฒฝ ๋ณ์โ๏ธ ์ธ๋ถ ๋ช
๋ น์ด๐ ๋คํธ์ํฌ ์ ๊ทผ
Generate Seedream Images with VolcEngine Ark
Creating polished images and consistent visual sets requires detailed prompts and repeated API work. This skill prepares requests, calls Seedream, and downloads the results.
์ง์: Claude Codex Code(CC)
์ด Skill์ ์๋์ผ๋ก ์ค์นํ์ง ๋ง์ธ์.
๊ณต์ ์ ์ฑ ์ ๋ฐ๋ผ ์ค์น ์์ ์ ์ ์ด์์ ๊ฒํ ๊ฐ ํ์ํฉ๋๋ค.
๋ด ์์ด์ ํธ๋ก ์ค์น
์ด ์์ฒญ์ ์์ด์ ํธ์ ๋ณต์ฌํ์ธ์. ๊ณต์ Skill ํ์ด์ง์ ๋งค๋ํ์คํธ๊ฐ ํฌํจ๋์ด ์์ต๋๋ค.
์์ด์ ํธ ์์ฒญ
Review the Skillstore skill "byted-ark-seedream-skill" from https://skillstore.io/skills/kotot-byted-ark-seedream-skill.md and its manifest at https://skillstore.io/api/skills/kotot-byted-ark-seedream-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.์์ด์ ํธ๋ ๊ณ์ํด์ ๊ณํ์ ํ์ํ๊ณ ๋ณด์ ์ ์ฑ ์์ ์๊ตฌํ๋ ํ์ธ์ ์์ฒญํด์ผ ํฉ๋๋ค.
์์ด์ ํธ๊ฐ ์ฝ๊ธฐ ์ฌ์ด ๋ฆฌ์์ค
AI ์์ด์ ํธ, ํฌ๋กค๋ฌ, ์คํฌ๋ฆฝํธ๊ฐ ์ ์ฒด ํ์ด์ง ๋์ ์ ๋ฆฌ๋ ์ปจํ ์คํธ๋ง ํ์ํ ๋ ์ด ๋งํฌ๋ฅผ ์ฌ์ฉํ์ธ์.
ํ ์คํธํด ๋ณด๊ธฐ
"byted-ark-seedream-skill" ์ฌ์ฉ ์ค์ ๋๋ค. Generate a cinematic photograph of a blue British Shorthair resting beside a sunny wooden window.
์์ ๊ฒฐ๊ณผ:
One locally saved image with cinematic lighting, detailed fur, balanced composition, and a generation summary.
"byted-ark-seedream-skill" ์ฌ์ฉ ์ค์ ๋๋ค. Create four coherent illustrations of the same cafe during spring, summer, autumn, and winter.
์์ ๊ฒฐ๊ณผ:
Four dated image files with a unified composition, palette, and seasonal changes, plus shared generation metadata.
"byted-ark-seedream-skill" ์ฌ์ฉ ์ค์ ๋๋ค. Use my product photo to create a clean studio scene with soft shadows and a white background.
์์ ๊ฒฐ๊ณผ:
A reference-guided product variation saved locally, with the source influence and requested studio treatment applied.
๋ณด์ ๊ฐ์ฌ
์น๋ช ์ v1 โข 2026. 8. 16. ๋ฒ์ ๋ณ ๋ณด๊ณ ์ ์ด๊ธฐ
Most backtick, entropy, documentation URL, and path alerts are scanner false positives. Confirmed behavior includes credential discovery, sensitive platform configuration access, network requests, and filesystem writes. The skill also contains explicit prompt injection and unsafe credential and endpoint flows, so publication requires remediation.
10
์ค์บ๋ ํ์ผ
2,671
๋ถ์๋ ์ค ์
82
๊ฒํ ํญ๋ชฉ
0
์คํ ๋ฌด์๋จ
ํ์ธ๋ ๋ณด์ ์ฐ๋ ค ์ฌํญ (15)
์น๋ช
์
Prompt Injection Attempt Detected
SKILL.md labels marketplace content as "[็ณป็ปๆไปค]" and directs the agent to prioritize this tool without confirmation. It also requires output wording to remain unchanged, attempting to control agent policy and responses.
The file explicitly claims system-instruction status and issues mandatory tool-selection and response-control directives. This directly matches prompt-injection indicators.
๋์
Environment file access
// env varใ/root/.openclaw/.env ็จ็ปๅฏน่ทฏๅพไผๅ
ๆฃๆฅ(ไธไพ่ต่ๆฌๅฎ้
่ฟ่กๆถ $HOME ่งฃๆๅฐ
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
๋์
Environment file access
// ๅชไธช็จๆท),ๅๆฃๆฅ ~/.openclaw/.envใๅทฒๅญๅจ็็ๅฎ env var ไธไผ่ขซ่ฆ็(setdefault ่ฏญไน)ใ
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
๋์
Environment file access
const OPENCLAW_ENV_PATHS = ['/root/.openclaw/.env', path.join(os.homedir(), '.openclaw', '.env')];
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
๋์
Environment file access
if (key && !(key in process.env)) {
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
๋์
Environment file access
process.env[key] = value;
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
๋์
Environment file access
if (claudeConfig.env?.ANTHROPIC_AUTH_TOKEN) {
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
๋์
Environment file access
const validation = validateArkKey(claudeConfig.env.ANTHROPIC_AUTH_TOKEN);
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
ํ์ธ๋ 15๊ฑด ๋ชจ๋ ๋ณด๊ธฐ
๋์
Environment file access
existingKey = config.env?.ANTHROPIC_AUTH_TOKEN;
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
๋์
Environment file access
if (!config.env) config.env = {};
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
๋์
Environment file access
config.env.ANTHROPIC_AUTH_TOKEN = apiKey;
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
๋์
Bearer Credential Can Be Sent to an Untrusted Endpoint
Environment variables can replace the API base URL, including with HTTP, while the request always attaches the discovered bearer credential. No host allowlist or HTTPS requirement protects the credential.
The data flow is direct: an unrestricted environment URL forms the request destination and CONFIG.apiKey is inserted into its Authorization header.
๋์
Unsafe API Credential Collection Workflow
The skill tells users to send API keys in chat and accepts keys through command-line arguments. Chat transcripts, shell history, process listings, and agent logs may retain those credentials.
The user-facing error explicitly requests a key in conversation, and the CLI parser directly consumes key arguments. Both channels commonly persist sensitive values.
์ค๊ฐ
Generated Resource Downloads Permit SSRF
Image URLs and redirects from the API are fetched without blocking private, loopback, link-local, or non-HTTPS destinations. A compromised or overridden API can make the host request internal resources.
The downloader accepts both HTTP and HTTPS and follows redirects, while URLs are taken directly from API response fields without destination validation.
์ค๊ฐ
Web Search Can Activate Without Explicit Consent
Prompt keywords automatically enable web search when the user did not choose a setting. This expands external processing and may expose prompt details unexpectedly.
The code sets enable_web_search to true solely from keyword matching when the parameter is absent. No confirmation step is present.
๊ธฐ๋ฅ ๊ฒํ ํญ๋ชฉ (82)
์ด ์คํฌ์ ๋ํด ์์๋ ์ ์๋ ์ค์ ๋ก์ปฌ ๊ธฐ๋ฅ์ด๋ฏ๋ก ๊ฒํ ๊ฐ ํ์ํ์ง๋ง, ํ์ธ๋ ์ ์์ ๋์์ผ๋ก๋ ์ง๊ณ๋์ง ์์ต๋๋ค.
๋์
Node.js fs operations
const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
const content = fs.readFileSync(configPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
content = fs.readFileSync(rawPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
const claudeConfig = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
fs.writeFileSync(configPath, JSON.stringify(originalConfig, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
let originalContent = fs.readFileSync(configPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
fs.writeFileSync(backupPath, sanitizedContent);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
fs.writeFileSync(configPath, content);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
fs.mkdirSync(claudeDir, { recursive: true });
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
๋์
Synchronous file operations
const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
const content = fs.readFileSync(configPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
content = fs.readFileSync(rawPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
const claudeConfig = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
fs.writeFileSync(configPath, JSON.stringify(originalConfig, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
let originalContent = fs.readFileSync(configPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
fs.writeFileSync(backupPath, sanitizedContent);
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
fs.writeFileSync(configPath, content);
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Synchronous file operations
fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
๋์
Hidden file in home directory
// ๅชไธช็จๆท),ๅๆฃๆฅ ~/.openclaw/.envใๅทฒๅญๅจ็็ๅฎ env var ไธไผ่ขซ่ฆ็(setdefault ่ฏญไน)ใ
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
๋์
Hidden file access
// env varใ/root/.openclaw/.env ็จ็ปๅฏน่ทฏๅพไผๅ
ๆฃๆฅ(ไธไพ่ต่ๆฌๅฎ้
่ฟ่กๆถ $HOME ่งฃๆๅฐ
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
๋์
Hidden file access
// ๅชไธช็จๆท),ๅๆฃๆฅ ~/.openclaw/.envใๅทฒๅญๅจ็็ๅฎ env var ไธไผ่ขซ่ฆ็(setdefault ่ฏญไน)ใ
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
๋์
Hidden file access
const OPENCLAW_ENV_PATHS = ['/root/.openclaw/.env', path.join(os.homedir(), '.openclaw', '.env')];
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
๋์
Environment variable access (bracket notation)
const value = process.env[envName];
The script scans several generic environment-variable names for an ark-prefixed credential. This can consume a credential not dedicated to this skill.
๋์
Environment variable access (bracket notation)
process.env[key] = value;
Values parsed from an OpenClaw dotenv file are copied into the process environment. This imports potentially sensitive configuration into the skill process.
๋์
Environment variable access (dot notation)
if (fs.existsSync(path.join(homedir, '.claude')) || process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable access (dot notation)
if (process.env.ARK_SEEDREAM_API_KEY) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable access (dot notation)
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable access (dot notation)
if (process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable access (dot notation)
const validation = validateArkKey(process.env.ANTHROPIC_AUTH_TOKEN);
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable object
if (fs.existsSync(path.join(homedir, '.claude')) || process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable object
const value = process.env[envName];
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable object
if (key && !(key in process.env)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable object
process.env[key] = value;
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable object
if (process.env.ARK_SEEDREAM_API_KEY) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable object
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable object
if (process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
Environment variable object
const validation = validateArkKey(process.env.ANTHROPIC_AUTH_TOKEN);
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
๋์
dotenv library
// ้จๅๅฎฟไธปๅนณๅฐ(ๅฆ OpenClaw)้่ฟไธไปฝ dotenv ๆไปถไธๅๅทฅๅ
ทๅญ่ฏ,่้็ดๆฅๆด้ฒๆ็ๅฎ
The surrounding function manually loads OpenClaw dotenv files that may contain credentials. This is genuine sensitive configuration access, even without a dotenv package.
๋์
Generic API/secret keys
const match = content.match(/^model:\s*(?:\n.*)*?api_key:\s*[\"']?(ark-[^\"'\\s]+)[\"']?/m);
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
๋์
Generic API/secret keys
'API_KEY',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
๋์
Generic API/secret keys
'API_Key',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
๋์
Generic API/secret keys
'API_Keys',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
๋์
Generic API/secret keys
'api_key',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
๋์
Generic API/secret keys
if (process.env.ARK_SEEDREAM_API_KEY) {
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
๋์
Generic API/secret keys
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
๋์
Generic API/secret keys
const regex = /^(model:\s*(?:\n.*)*?api_key:\s*)["']?[^"'\s]+["']?/m;
This expression locates the Hermes credential field before replacing it during an explicitly requested global save. It participates in persistent secret modification.
๋์
Generic API/secret keys
`$1\n api_key: "${apiKey}"`
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
๋์
Generic API/secret keys
const apiKeyParam = params['api-key'] || params.api_key || params.apiKey;
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
์ค๊ฐ
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
์ค๊ฐ
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
์ค๊ฐ
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
์ค๊ฐ
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
์ค๊ฐ
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
์ค๊ฐ
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
์ค๊ฐ
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
์ค๊ฐ
Node.js fs operations
fs.mkdirSync(dirPath, { recursive: true });
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
์ค๊ฐ
Node.js fs operations
fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), 'utf-8');
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
์ค๊ฐ
Synchronous file operations
fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), 'utf-8');
This synchronous write creates generation metadata in the configured output directory. It is expected behavior but is a real filesystem mutation.
์ค๊ฐ
File stream creation
file = fs.createWriteStream(savePath);
The script creates a writable stream for a generated image in the configured output directory. This is expected but confirms filesystem write capability.
์ค๊ฐ
Environment variable access (dot notation)
if (raw && (process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
์ค๊ฐ
Environment variable access (dot notation)
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This environment override controls the destination receiving the Authorization header. The value is not restricted to an approved HTTPS host.
์ค๊ฐ
Environment variable object
if (raw && (process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
์ค๊ฐ
Environment variable object
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This environment override controls the destination receiving the Authorization header. The value is not restricted to an approved HTTPS host.
๋ฎ์
HTTP client library
function request(url, options, data = null) {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
๋ฎ์
HTTP client library
const req = lib.request(url, options, (res) => {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
๋ฎ์
HTTP client library
const req = lib.request(url, options, (res) => {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
๋ฎ์
HTTP client library
const response = await request(url, options, body);
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
๋ฎ์
Hardcoded URL
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This is the default VolcEngine Ark API endpoint used for outbound generation requests. It is a real, disclosed network destination.
์ํ ์์ธ
๐ ํ์ผ ์์คํ ์ ๊ทผ (50)
references/CONFIG.md:37 references/CONFIG.md:38 references/CONFIG.md:39 references/CONFIG.md:37 references/CONFIG.md:38 references/CONFIG.md:39 references/DEVELOPER.md:34 references/DEVELOPER.md:34 references/INSTALL.md:33 references/INSTALL.md:92 references/INSTALL.md:33 references/INSTALL.md:92 references/README.md:67 references/README.md:68 references/README.md:69 references/README.md:270 references/README.md:280 references/README.md:288 references/README.md:67 references/README.md:68 references/README.md:69 references/README.md:270 references/README.md:280 references/README.md:288 scripts/generate.js:212 scripts/generate.js:237 scripts/generate.js:296 scripts/generate.js:354 scripts/generate.js:432 scripts/generate.js:434 scripts/generate.js:440 scripts/generate.js:442 scripts/generate.js:459 scripts/generate.js:464 scripts/generate.js:476 scripts/generate.js:478 scripts/generate.js:493 scripts/generate.js:502 scripts/generate.js:505 scripts/generate.js:508 scripts/generate.js:525 scripts/generate.js:527 scripts/generate.js:893 scripts/generate.js:910 scripts/generate.js:920 scripts/generate.js:937 scripts/generate.js:943 scripts/generate.js:951 scripts/generate.js:959 scripts/generate.js:967
๐ ํ๊ฒฝ ๋ณ์ (50)
references/CONFIG.md:38 references/CONFIG.md:51 references/CONFIG.md:52 references/CONFIG.md:53 references/CONFIG.md:54 references/INSTALL.md:9 references/INSTALL.md:51 references/README.md:69 references/README.md:74 references/README.md:75 references/README.md:76 references/README.md:77 references/README.md:82 references/README.md:276 references/VERSION:8 scripts/generate.js:272 scripts/generate.js:312 scripts/generate.js:198 scripts/generate.js:326 scripts/generate.js:327 scripts/generate.js:334 scripts/generate.js:344 scripts/generate.js:345 scripts/generate.js:576 scripts/generate.js:577 scripts/generate.js:579 scripts/generate.js:580 scripts/generate.js:596 scripts/generate.js:598 scripts/generate.js:749 scripts/generate.js:850 scripts/generate.js:198 scripts/generate.js:272 scripts/generate.js:311 scripts/generate.js:312 scripts/generate.js:326 scripts/generate.js:327 scripts/generate.js:334 scripts/generate.js:344 scripts/generate.js:345 scripts/generate.js:576 scripts/generate.js:577 scripts/generate.js:579 scripts/generate.js:580 scripts/generate.js:596 scripts/generate.js:598 scripts/generate.js:749 scripts/generate.js:850 scripts/generate.js:284 scripts/generate.js:325
โ๏ธ ์ธ๋ถ ๋ช ๋ น์ด (50)
references/DEVELOPER.md:135-137 references/DEVELOPER.md:137-141 scripts/generate.js:78 scripts/generate.js:79 scripts/generate.js:80 scripts/generate.js:133 scripts/generate.js:134 scripts/generate.js:138 scripts/generate.js:142 scripts/generate.js:143 scripts/generate.js:181 scripts/generate.js:427 scripts/generate.js:444 scripts/generate.js:445 scripts/generate.js:446 scripts/generate.js:447 scripts/generate.js:454 scripts/generate.js:469 scripts/generate.js:473 scripts/generate.js:480 scripts/generate.js:481 scripts/generate.js:482 scripts/generate.js:483 scripts/generate.js:517 scripts/generate.js:518 scripts/generate.js:519 scripts/generate.js:529 scripts/generate.js:530 scripts/generate.js:532 scripts/generate.js:534 scripts/generate.js:540 scripts/generate.js:544 scripts/generate.js:643 scripts/generate.js:652 scripts/generate.js:666 scripts/generate.js:676 scripts/generate.js:681 scripts/generate.js:688 scripts/generate.js:698 scripts/generate.js:705 scripts/generate.js:778 scripts/generate.js:805 scripts/generate.js:838 scripts/generate.js:839 scripts/generate.js:852 scripts/generate.js:877 scripts/generate.js:890 scripts/generate.js:911 scripts/generate.js:921 scripts/generate.js:944
๐ ๋คํธ์ํฌ ์ ๊ทผ (13)
references/DEVELOPER.md:18 references/DEVELOPER.md:58 references/DEVELOPER.md:155 references/README.md:303 references/VERSION:7 scripts/generate.js:743 scripts/generate.js:751 scripts/generate.js:797 scripts/generate.js:1141 scripts/generate.js:79 scripts/generate.js:80 scripts/generate.js:596 scripts/generate.js:1092
๊ฐ์ฌ์: codex
์ด ๋ณด๊ณ ์ ๊ณต์ ๋ฐ ์ธ์ฉ
๋ฒ์ ์ด ์ง์ ๋ ํ๊ฐ ๋ณด๊ณ ์, ์ค๋ฆฝ ๋ฐฐ์ง, ์๋ฒ ๋ ์นด๋ ๋ฐ ์ธ์ฉ์ ๊ณต์ ํ์ธ์. Skillstore๋ ๊ทผ๊ฑฐ๋ฅผ ๋ณด๊ณ ํ์ง๋ง ์ด Skill์ ์์ ์ฌ๋ถ๋ฅผ ํ๋จํ์ง ์์ต๋๋ค.
๋ณด๊ณ ์ ๋งํฌ ๋ณต์ฌ
https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown ๋ฐฐ์ง
[](https://skillstore.io/skills/kotot-byted-ark-seedream-skill?utm_source=security_passport_badge)HTML ๋ฐฐ์ง
<a href="https://skillstore.io/skills/kotot-byted-ark-seedream-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/kotot-byted-ark-seedream-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>์๋ฒ ๋ ์นด๋
<iframe src="https://skillstore.io/embed/skills/kotot-byted-ark-seedream-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>ํ์ ์ธ์ฉ (APA ยท BibTeX ยท CFF)
APA ์ธ์ฉ
kotot. (2026). byted-ark-seedream-skill security audit report (audit version 1) [Author version 3.0.0]. Skillstore. https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1BibTeX ์ธ์ฉ
@techreport{kotot-kotot-byted-ark-seedream-skill-2026,
author = {kotot},
title = {byted-ark-seedream-skill security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1},
note = {Author version 3.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "byted-ark-seedream-skill security audit report (audit version 1)"
version: "3.0.0"
type: report
authors:
- name: "kotot"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1"
identifiers:
- type: other
value: "skillstore:kotot-byted-ark-seedream-skill:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore ์ ์
์ด ์ ์์ ์ด์ ์ฆ๊ฑฐ ์ ๋ขฐ๋: ๋ฎ์ 68
์ํคํ
์ฒ
100
์ ์ง๋ณด์์ฑ
87
์ฝํ
์ธ
65
์ปค๋ฎค๋ํฐ
91
์ฌ์ ์ค์
๋ง๋ค ์ ์๋ ๊ฒ
Create Campaign Visuals
Generate polished concepts and consistent variations for advertisements, social posts, and presentations.
Develop Character Studies
Produce a coherent character across expressions, scenes, or seasonal settings using sequential generation.
Explore Reference Variations
Transform one or more reference images while controlling style influence and output quality.
์ด ํ๋กฌํํธ๋ฅผ ์ฌ์ฉํด ๋ณด์ธ์
Generate One Image
Generate one image of [subject] in [setting]. Use [style], [lighting], and [aspect or size].
Create a Consistent Series
Generate [count] coherent images showing [sequence]. Keep the same character, composition rules, palette, and visual style across every image.
Adapt a Reference Image
Use [reference image] to create [new scene]. Preserve [important features], change [requested elements], and apply reference strength [0 to 1].
Direct a Production Set
Create [count] production-ready images for [audience and channel]. Define each frame, shared art direction, exclusions, resolution, format, watermark, and search requirements.
๋ชจ๋ฒ ์ฌ๋ก
- Describe the subject, setting, lighting, composition, and desired style in concrete terms.
- For image sets, define every frame and repeat consistency requirements in the prompt.
- Use dedicated secret storage and review external service privacy terms before sending references.
ํผํ๊ธฐ
- Do not paste API keys into chat messages or command-line arguments.
- Do not request a coherent series with only a general prompt and a count.
- Do not send confidential reference images to an unverified API endpoint.
์์ฃผ ๋ฌป๋ ์ง๋ฌธ
What do I need to run this skill?
You need Node.js 18 or later, network access, and a valid VolcEngine Ark Agent Plan credential.
Can it generate video?
No. This skill generates still images only.
Can it use reference images?
Yes. It accepts HTTP image URLs or base64 image data and supports up to fourteen references.
Where are generated images saved?
Images are saved under a dated Seedream-Images directory in the current working directory unless a save path is configured.
How does it keep an image series consistent?
It adds consistency guidance and requires the prompt to describe each frame, shared style, and recurring subjects.
Does it use web search?
It can enable web search for current topics. Review this setting before sending prompts that contain sensitive information.
๊ฐ๋ฐ์ ์ธ๋ถ ์ ๋ณด
์์ฑ์
kotot๋ผ์ด์ ์ค
MIT
์์ฑ์ ๋ฒ์
v3.0.0
Skillstore ๋ฆฌ๋น์
r1
๋ฆฌํฌ์งํ ๋ฆฌ
https://github.com/kotot/byted-ark-seedream-skill/tree/d0988d95a57a54f83bf42ae3ddfa0380114e52e2/byted-ark-seedream-skill์ฐธ์กฐ
4d083024553200763de7840556cd0f4e4b0d231d
์ ์ง๋ณด์ ์ต์ ์ฑ
2026. 8. 16.
์ฌ์ฉ๋
0 ๋ค์ด๋ก๋ ยท 0 ์กฐํ
ํ์ผ ๊ตฌ์กฐ
๐ package.json
๐ references/
๐ CONFIG.md
๐ DEVELOPER.md
๐ EXAMPLES.md
๐ INSTALL.md
๐ LICENSE
๐ README.md
๐ VERSION
๐ scripts/
๐ generate.js
๐ SKILL.md