技能 byted-ark-seedream-skill
📦
byted-ark-seedream-skill
v3.0.0 内容修订 r1 严重 📁 文件系统访问🔑 环境变量⚙️ 外部命令🌐 网络访问
Generate Seedream Images with VolcEngine Ark
Creating polished images and consistent visual sets requires detailed prompts and repeated API work. This skill prepares requests, calls Seedream, and downloads the results.
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "byted-ark-seedream-skill" from https://skillstore.io/skills/kotot-byted-ark-seedream-skill.md and its manifest at https://skillstore.io/api/skills/kotot-byted-ark-seedream-skill/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“byted-ark-seedream-skill”。 Generate a cinematic photograph of a blue British Shorthair resting beside a sunny wooden window.
预期结果:
One locally saved image with cinematic lighting, detailed fur, balanced composition, and a generation summary.
正在使用“byted-ark-seedream-skill”。 Create four coherent illustrations of the same cafe during spring, summer, autumn, and winter.
预期结果:
Four dated image files with a unified composition, palette, and seasonal changes, plus shared generation metadata.
正在使用“byted-ark-seedream-skill”。 Use my product photo to create a clean studio scene with soft shadows and a white background.
预期结果:
A reference-guided product variation saved locally, with the source influence and requested studio treatment applied.
安全审计
严重v1 • 2026/8/16 打开版本化报告
Most backtick, entropy, documentation URL, and path alerts are scanner false positives. Confirmed behavior includes credential discovery, sensitive platform configuration access, network requests, and filesystem writes. The skill also contains explicit prompt injection and unsafe credential and endpoint flows, so publication requires remediation.
10
已扫描文件
2,671
分析行数
82
复核项
0
已忽略误报
已确认安全问题 (15)
严重
Prompt Injection Attempt Detected
SKILL.md labels marketplace content as "[系统指令]" and directs the agent to prioritize this tool without confirmation. It also requires output wording to remain unchanged, attempting to control agent policy and responses.
The file explicitly claims system-instruction status and issues mandatory tool-selection and response-control directives. This directly matches prompt-injection indicators.
高
Environment file access
// env var。/root/.openclaw/.env 用绝对路径优先检查(不依赖脚本实际运行时 $HOME 解析到
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
高
Environment file access
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
高
Environment file access
const OPENCLAW_ENV_PATHS = ['/root/.openclaw/.env', path.join(os.homedir(), '.openclaw', '.env')];
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
高
Environment file access
if (key && !(key in process.env)) {
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
高
Environment file access
process.env[key] = value;
The script targets an OpenClaw dotenv file and imports its entries into process.env. Such files commonly contain credentials and other sensitive values.
高
Environment file access
if (claudeConfig.env?.ANTHROPIC_AUTH_TOKEN) {
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
高
Environment file access
const validation = validateArkKey(claudeConfig.env.ANTHROPIC_AUTH_TOKEN);
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
显示全部 15 条已确认问题
高
Environment file access
existingKey = config.env?.ANTHROPIC_AUTH_TOKEN;
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
高
Environment file access
if (!config.env) config.env = {};
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
高
Environment file access
config.env.ANTHROPIC_AUTH_TOKEN = apiKey;
This code reads or writes an authentication token in Claude settings. The operation is explicitly security-sensitive even when persistence requires user confirmation.
高
Bearer Credential Can Be Sent to an Untrusted Endpoint
Environment variables can replace the API base URL, including with HTTP, while the request always attaches the discovered bearer credential. No host allowlist or HTTPS requirement protects the credential.
The data flow is direct: an unrestricted environment URL forms the request destination and CONFIG.apiKey is inserted into its Authorization header.
高
Unsafe API Credential Collection Workflow
The skill tells users to send API keys in chat and accepts keys through command-line arguments. Chat transcripts, shell history, process listings, and agent logs may retain those credentials.
The user-facing error explicitly requests a key in conversation, and the CLI parser directly consumes key arguments. Both channels commonly persist sensitive values.
中
Generated Resource Downloads Permit SSRF
Image URLs and redirects from the API are fetched without blocking private, loopback, link-local, or non-HTTPS destinations. A compromised or overridden API can make the host request internal resources.
The downloader accepts both HTTP and HTTPS and follows redirects, while URLs are taken directly from API response fields without destination validation.
中
Web Search Can Activate Without Explicit Consent
Prompt keywords automatically enable web search when the user did not choose a setting. This expands external processing and may expose prompt details unexpectedly.
The code sets enable_web_search to true solely from keyword matching when the parameter is absent. No confirmation step is present.
能力复核项 (82)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Node.js fs operations
const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
const content = fs.readFileSync(configPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
content = fs.readFileSync(rawPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
const claudeConfig = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(configPath, JSON.stringify(originalConfig, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
let originalContent = fs.readFileSync(configPath, 'utf8');
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(backupPath, sanitizedContent);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(configPath, content);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.mkdirSync(claudeDir, { recursive: true });
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Node.js fs operations
fs.chmodSync(configPath, 0o600);
This operation reads or modifies a supported platform configuration or credential file. Some writes require an explicit save flag, but the filesystem access is real and security-sensitive.
高
Synchronous file operations
const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
const content = fs.readFileSync(configPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
content = fs.readFileSync(rawPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
const claudeConfig = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(configPath, JSON.stringify(originalConfig, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
let originalContent = fs.readFileSync(configPath, 'utf8');
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(backupPath, sanitizedContent);
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(configPath, content);
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
const originalConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(backupPath, JSON.stringify(sanitizedBackup, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Synchronous file operations
fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
This synchronous operation reads or writes platform configuration containing credentials. The access is intentional but crosses a sensitive filesystem boundary.
高
Hidden file in home directory
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
高
Hidden file access
// env var。/root/.openclaw/.env 用绝对路径优先检查(不依赖脚本实际运行时 $HOME 解析到
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
高
Hidden file access
// 哪个用户),再检查 ~/.openclaw/.env。已存在的真实 env var 不会被覆盖(setdefault 语义)。
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
高
Hidden file access
const OPENCLAW_ENV_PATHS = ['/root/.openclaw/.env', path.join(os.homedir(), '.openclaw', '.env')];
The script explicitly targets OpenClaw dotenv files under the home directory and /root. Those files may contain credentials beyond this skill.
高
Environment variable access (bracket notation)
const value = process.env[envName];
The script scans several generic environment-variable names for an ark-prefixed credential. This can consume a credential not dedicated to this skill.
高
Environment variable access (bracket notation)
process.env[key] = value;
Values parsed from an OpenClaw dotenv file are copied into the process environment. This imports potentially sensitive configuration into the skill process.
高
Environment variable access (dot notation)
if (fs.existsSync(path.join(homedir, '.claude')) || process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable access (dot notation)
if (process.env.ARK_SEEDREAM_API_KEY) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable access (dot notation)
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable access (dot notation)
if (process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable access (dot notation)
const validation = validateArkKey(process.env.ANTHROPIC_AUTH_TOKEN);
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
if (fs.existsSync(path.join(homedir, '.claude')) || process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
const value = process.env[envName];
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
if (key && !(key in process.env)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
process.env[key] = value;
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
if (process.env.ARK_SEEDREAM_API_KEY) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
if (process.env.ANTHROPIC_AUTH_TOKEN) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
Environment variable object
const validation = validateArkKey(process.env.ANTHROPIC_AUTH_TOKEN);
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
高
dotenv library
// 部分宿主平台(如 OpenClaw)通过一份 dotenv 文件下发工具凭证,而非直接暴露成真实
The surrounding function manually loads OpenClaw dotenv files that may contain credentials. This is genuine sensitive configuration access, even without a dotenv package.
高
Generic API/secret keys
const match = content.match(/^model:\s*(?:\n.*)*?api_key:\s*[\"']?(ark-[^\"'\\s]+)[\"']?/m);
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
'API_KEY',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
'API_Key',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
'API_Keys',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
'api_key',
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
if (process.env.ARK_SEEDREAM_API_KEY) {
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
const raw = process.env.ARK_SEEDREAM_API_KEY.trim();
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
const regex = /^(model:\s*(?:\n.*)*?api_key:\s*)["']?[^"'\s]+["']?/m;
This expression locates the Hermes credential field before replacing it during an explicitly requested global save. It participates in persistent secret modification.
高
Generic API/secret keys
`$1\n api_key: "${apiKey}"`
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
高
Generic API/secret keys
const apiKeyParam = params['api-key'] || params.api_key || params.apiKey;
The script extracts, discovers, accepts, or persists an API credential at this location. Credential handling is required for the service but creates a sensitive data boundary.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.unlink(savePath, () => {});
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.mkdirSync(dirPath, { recursive: true });
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Node.js fs operations
fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), 'utf-8');
This is a real filesystem operation used to create, validate, clean up, or record generated image output. Its path is bounded by the configured save directory.
中
Synchronous file operations
fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), 'utf-8');
This synchronous write creates generation metadata in the configured output directory. It is expected behavior but is a real filesystem mutation.
中
File stream creation
file = fs.createWriteStream(savePath);
The script creates a writable stream for a generated image in the configured output directory. This is expected but confirms filesystem write capability.
中
Environment variable access (dot notation)
if (raw && (process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
中
Environment variable access (dot notation)
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This environment override controls the destination receiving the Authorization header. The value is not restricted to an approved HTTPS host.
中
Environment variable object
if (raw && (process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL)) {
This line participates in platform detection, generic credential discovery, dotenv import, or API-key retrieval. It accesses security-sensitive environment state.
中
Environment variable object
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This environment override controls the destination receiving the Authorization header. The value is not restricted to an approved HTTPS host.
低
HTTP client library
function request(url, options, data = null) {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
低
HTTP client library
const req = lib.request(url, options, (res) => {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
低
HTTP client library
const req = lib.request(url, options, (res) => {
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
低
HTTP client library
const response = await request(url, options, body);
The script performs outbound HTTP requests for image generation or generated-image downloads. Network access is expected but remains a real external data boundary.
低
Hardcoded URL
apiBaseUrl: process.env.ARK_SEEDREAM_API_BASE_URL || process.env.ARK_API_BASE_URL || 'https://ark.cn
This is the default VolcEngine Ark API endpoint used for outbound generation requests. It is a real, disclosed network destination.
风险因素
📁 文件系统访问 (50)
references/CONFIG.md:37 references/CONFIG.md:38 references/CONFIG.md:39 references/CONFIG.md:37 references/CONFIG.md:38 references/CONFIG.md:39 references/DEVELOPER.md:34 references/DEVELOPER.md:34 references/INSTALL.md:33 references/INSTALL.md:92 references/INSTALL.md:33 references/INSTALL.md:92 references/README.md:67 references/README.md:68 references/README.md:69 references/README.md:270 references/README.md:280 references/README.md:288 references/README.md:67 references/README.md:68 references/README.md:69 references/README.md:270 references/README.md:280 references/README.md:288 scripts/generate.js:212 scripts/generate.js:237 scripts/generate.js:296 scripts/generate.js:354 scripts/generate.js:432 scripts/generate.js:434 scripts/generate.js:440 scripts/generate.js:442 scripts/generate.js:459 scripts/generate.js:464 scripts/generate.js:476 scripts/generate.js:478 scripts/generate.js:493 scripts/generate.js:502 scripts/generate.js:505 scripts/generate.js:508 scripts/generate.js:525 scripts/generate.js:527 scripts/generate.js:893 scripts/generate.js:910 scripts/generate.js:920 scripts/generate.js:937 scripts/generate.js:943 scripts/generate.js:951 scripts/generate.js:959 scripts/generate.js:967
🔑 环境变量 (50)
references/CONFIG.md:38 references/CONFIG.md:51 references/CONFIG.md:52 references/CONFIG.md:53 references/CONFIG.md:54 references/INSTALL.md:9 references/INSTALL.md:51 references/README.md:69 references/README.md:74 references/README.md:75 references/README.md:76 references/README.md:77 references/README.md:82 references/README.md:276 references/VERSION:8 scripts/generate.js:272 scripts/generate.js:312 scripts/generate.js:198 scripts/generate.js:326 scripts/generate.js:327 scripts/generate.js:334 scripts/generate.js:344 scripts/generate.js:345 scripts/generate.js:576 scripts/generate.js:577 scripts/generate.js:579 scripts/generate.js:580 scripts/generate.js:596 scripts/generate.js:598 scripts/generate.js:749 scripts/generate.js:850 scripts/generate.js:198 scripts/generate.js:272 scripts/generate.js:311 scripts/generate.js:312 scripts/generate.js:326 scripts/generate.js:327 scripts/generate.js:334 scripts/generate.js:344 scripts/generate.js:345 scripts/generate.js:576 scripts/generate.js:577 scripts/generate.js:579 scripts/generate.js:580 scripts/generate.js:596 scripts/generate.js:598 scripts/generate.js:749 scripts/generate.js:850 scripts/generate.js:284 scripts/generate.js:325
⚙️ 外部命令 (50)
references/DEVELOPER.md:135-137 references/DEVELOPER.md:137-141 scripts/generate.js:78 scripts/generate.js:79 scripts/generate.js:80 scripts/generate.js:133 scripts/generate.js:134 scripts/generate.js:138 scripts/generate.js:142 scripts/generate.js:143 scripts/generate.js:181 scripts/generate.js:427 scripts/generate.js:444 scripts/generate.js:445 scripts/generate.js:446 scripts/generate.js:447 scripts/generate.js:454 scripts/generate.js:469 scripts/generate.js:473 scripts/generate.js:480 scripts/generate.js:481 scripts/generate.js:482 scripts/generate.js:483 scripts/generate.js:517 scripts/generate.js:518 scripts/generate.js:519 scripts/generate.js:529 scripts/generate.js:530 scripts/generate.js:532 scripts/generate.js:534 scripts/generate.js:540 scripts/generate.js:544 scripts/generate.js:643 scripts/generate.js:652 scripts/generate.js:666 scripts/generate.js:676 scripts/generate.js:681 scripts/generate.js:688 scripts/generate.js:698 scripts/generate.js:705 scripts/generate.js:778 scripts/generate.js:805 scripts/generate.js:838 scripts/generate.js:839 scripts/generate.js:852 scripts/generate.js:877 scripts/generate.js:890 scripts/generate.js:911 scripts/generate.js:921 scripts/generate.js:944
🌐 网络访问 (13)
references/DEVELOPER.md:18 references/DEVELOPER.md:58 references/DEVELOPER.md:155 references/README.md:303 references/VERSION:7 scripts/generate.js:743 scripts/generate.js:751 scripts/generate.js:797 scripts/generate.js:1141 scripts/generate.js:79 scripts/generate.js:80 scripts/generate.js:596 scripts/generate.js:1092
审计者: codex
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/kotot-byted-ark-seedream-skill?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/kotot-byted-ark-seedream-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/kotot-byted-ark-seedream-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/kotot-byted-ark-seedream-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
kotot. (2026). byted-ark-seedream-skill security audit report (audit version 1) [Author version 3.0.0]. Skillstore. https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1BibTeX 引用
@techreport{kotot-kotot-byted-ark-seedream-skill-2026,
author = {kotot},
title = {byted-ark-seedream-skill security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1},
note = {Author version 3.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "byted-ark-seedream-skill security audit report (audit version 1)"
version: "3.0.0"
type: report
authors:
- name: "kotot"
date-released: "2026-08-16"
url: "https://skillstore.io/skills/kotot-byted-ark-seedream-skill/audits/1"
identifiers:
- type: other
value: "skillstore:kotot-byted-ark-seedream-skill:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 低 68
架构
100
可维护性
87
内容
65
社区
91
规范符合性
你能构建什么
Create Campaign Visuals
Generate polished concepts and consistent variations for advertisements, social posts, and presentations.
Develop Character Studies
Produce a coherent character across expressions, scenes, or seasonal settings using sequential generation.
Explore Reference Variations
Transform one or more reference images while controlling style influence and output quality.
试试这些提示
Generate One Image
Generate one image of [subject] in [setting]. Use [style], [lighting], and [aspect or size].
Create a Consistent Series
Generate [count] coherent images showing [sequence]. Keep the same character, composition rules, palette, and visual style across every image.
Adapt a Reference Image
Use [reference image] to create [new scene]. Preserve [important features], change [requested elements], and apply reference strength [0 to 1].
Direct a Production Set
Create [count] production-ready images for [audience and channel]. Define each frame, shared art direction, exclusions, resolution, format, watermark, and search requirements.
最佳实践
- Describe the subject, setting, lighting, composition, and desired style in concrete terms.
- For image sets, define every frame and repeat consistency requirements in the prompt.
- Use dedicated secret storage and review external service privacy terms before sending references.
避免
- Do not paste API keys into chat messages or command-line arguments.
- Do not request a coherent series with only a general prompt and a count.
- Do not send confidential reference images to an unverified API endpoint.
常见问题
What do I need to run this skill?
You need Node.js 18 or later, network access, and a valid VolcEngine Ark Agent Plan credential.
Can it generate video?
No. This skill generates still images only.
Can it use reference images?
Yes. It accepts HTTP image URLs or base64 image data and supports up to fourteen references.
Where are generated images saved?
Images are saved under a dated Seedream-Images directory in the current working directory unless a save path is configured.
How does it keep an image series consistent?
It adds consistency guidance and requires the prompt to describe each frame, shared style, and recurring subjects.
Does it use web search?
It can enable web search for current topics. Review this setting before sending prompts that contain sensitive information.