ClawHub

Chanjing Text To Digital Person

v1.0.6

Use Chanjing text-to-digital-person APIs for AI portraits, talking videos, optional LoRA training, polling, and explicit downloads when requested.

⭐ 0· 153·1 current·1 all-time
by@binkes
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the included scripts and manifest: the package implements API calls for photo/motion/LoRA tasks against open-api.chanjing.cc, and the credential model (credentials.json with app_id/secret_key/access_token) is consistent with that purpose. Allowed hosts and allowed command (python3) in manifest align with functionality.
✓
Instruction Scope
SKILL.md and scripts limit actions to reading/writing the declared credentials.json, calling the documented Chanjing endpoints, polling task status, and downloading output only when explicitly requested. The only out-of-skill behaviors are opening a browser or invoking a local credentials-guard script when credentials are missing—this behavior is documented in SKILL.md/manifest.
✓
Install Mechanism
No install spec or remote downloads; the skill is delivered as scripts that run under python3. There are no third-party installers or archive extraction steps that would write or execute arbitrary code from external URLs.
✓
Credentials
No unexpected environment variables or unrelated credentials are requested. The skill uses a local credentials.json (default ~/.chanjing/credentials.json) to store app_id/secret_key and persists access_token to disk — this persistence is declared in the manifest and is proportionate to the need to use the API.
ℹ
Persistence & Privilege
The skill persists access_token/expire_in back to credentials.json (persistAccessTokenOnDisk: true), and will open a browser or call a local guard script if AK/SK are missing. alwaysSkill is false and the skill does not modify other skills or global agent settings per manifest.
Assessment
This skill appears to do what it says: call Chanjing APIs, poll tasks, and optionally download outputs. Before installing: (1) Confirm you trust the Chanjing service (open-api.chanjing.cc) because API requests and output URLs go there; (2) be aware credentials (app_id/secret_key) are stored in ~/.chanjing/credentials.json and the skill will persist access_token to that file — keep that file out of version control (manifest already notes doNotCommitToVcs); (3) when asked to download a URL, the downloader will fetch any URL you provide — only request downloads from trusted URLs; (4) the skill may open your browser or run a local credentials-guard script if credentials are missing, which is documented but worth confirming the guard script you have is the expected one; (5) avoid uploading/pointing to sensitive personal photos unless you accept the provider's privacy/usage terms. Overall the package is internally consistent and documented.

Like a lobster shell, security has layers — review code before you run it.

latestvk97djkjthfb7sx709zvzn08ac583qmd3

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments