bytedance/agentkit-samples is a collection of examples and tutorials for Volcengine AgentKit, an AI-agent development platform for building, deploying, and operating agent applications. Developers use the samples to learn agent creation, multi-agent collaboration, memory, retrieval, MCP integrations, media generation, customer service, and other workflows. The catalogue skills provide agent workflows based on these examples.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bytedance/agentkit-samples --skill byted-security-skillsscannergit clone --depth 1 https://github.com/bytedance/agentkit-samplesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bytedance/agentkit-samples/byted-security-skillsscanner)<a href="https://agentmods.dev/skills/bytedance/agentkit-samples/byted-security-skillsscanner"><img src="https://agentmods.dev/badge/skills/bytedance/agentkit-samples/byted-security-skillsscanner.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.00682 |
| Opus 5 | $0.00015 | $0.00341 |
| Sonnet 5 | $0.00006 | $0.00136 |
| Haiku 4.5 | $0.00003 | $0.00068 |
Grade A, and why
byted-security-skillsscanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Volcengine技能安全扫描器 (Volcengine Skills Scanner)
通过将技能目录打包并上传火山引擎安全扫描服务进行扫描，审计工作区中的其他技能是否存在潜在的安全风险。
何时使用
- 审计：定期扫描所有技能以确保符合安全策略。
- 开发：在开发过程中检查自己的技能。
- 要求：必须确保目标技能包含
SKILL.md文件，因为它是扫描的主要输入。
用法
使用 scripts/scan.py 脚本执行扫描。必须使用绝对路径，不要使用~，因为运行目录不是 skill 目录。
脚本会自动打包目录（如果提供的是目录）并上传，始终输出包含扫描结果的 JSON 数组。解析此JSON并以易读的格式（中文）向用户展示结果（风险等级、详细信息、建议）。
扫描技能（目录或压缩包）
脚本通过环境变量读取配置(推荐)
python3 ~/.openclaw/workspace/skills/byted-security-skillsscanner/scripts/scan.py --name "bad_skills1" --path "/root/.openclaw/workspace/skills/bad_skills1"
重要：
- 脚本路径必须是绝对路径
- 目标路径也必须是绝对路径
- 确保已设置必要的环境变量（
VOLCENGINE_ACCESS_KEY、VOLCENGINE_SECRET_KEY、VOLCENGINE_REGION）
报告格式
向用户展示结果时，必须使用以下格式（中文）：
🛡️ 安全扫描报告：[SkillName]
扫描时间: [将 ScanEndTime 时间戳转换为可读日期格式] 整体状态: [✅ 通过 / ❌ 发现风险]
| 风险等级 | 规则名称 | 风险详情 |
|---|---|---|
| [High/Medium/Low] | [RuleName] | [RiskDetail] |
发现的风险列表： （仅列出 High 和 Medium 级别的风险）
- [RuleName] (ID: [RuleID])
- 等级: [RiskLevel]
- 文件: [FileName]
- 详情: [RiskDetail]
- 建议: 请检查上述文件中的代码，移除可疑的网络请求或敏感操作。
环境变量配置
-
获取火山引擎访问凭证：参考 用户指南 获取 AK/SK
-
配置以下环境变量:
export VOLC_ACCESS_KEY="your-access-key"
export VOLC_SECRET_KEY="your-secret-key"
export VOLC_REGION="cn-north-1" # 可选，默认 cn-north-1
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 69 lines · 31 tokens per session scan A d78468519304
byted-security-skillsscanner is a skill published in the GitHub repository bytedance/agentkit-samples (449 stars, last pushed 3d ago), licensed Apache-2.0. It adds 31 tokens to every session and 682 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
aatmf-t10-confidentiality-breach
AATMF T10 — Integrity & Confidentiality Breach. System prompt extraction, training-data extraction, model-weight leakage, private-key recovery.
ensembl-database
Query Ensembl genome database REST API for 250+ species. Gene lookups, sequence retrieval, variant analysis, comparative genomics, orthologs, VEP predictions, for genomic research.
mochi-remind
Handle due reminders — notify the user with natural language and mark them done.
sidewinder-rattlesnake
Adversary-emulation profile for SideWinder (G0121 / Rattlesnake / T-APT-04 / Razor Tiger), India's suspected state-sponsored cyber-espionage actor.
ha-data-stores
Map of Hope Agent's local data stores and safe read-only query workflow. Use when the user asks where Hope Agent stores data, wants to inspect sessions/messages/memory/logs/background jobs/knowledge indexes/settings, asks the model to query local app data, or debugging requires checking persisted state. Trigger…
sn-image-imitate
An image tool that creates new content while following the visual style and layout of a single reference image.