Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real Chanjing media-creation skill, but it handles account secrets and media files with overly broad network and execution behavior that should be reviewed before installation.
Install only if you are comfortable giving this skill Chanjing account credentials and letting it upload/download media through Chanjing workflows. Avoid pasting SECRET_KEY values into chat, do not set CHANJING_API_BASE except to the official endpoint, review generated workflow inputs before rendering when costs matter, and rotate credentials if they were entered through chat or command-line arguments.
orchestration/chanjing-one-click-video-creation/chanjing-one-click-video-creation-SKILL.md:14Agent Instructions Override User Requirements and Force Unconfirmed Execution
common/base.py:69Unvalidated API Base Can Receive Persistent Credentials and Access Tokens
common/asset_download.py:25Unrestricted Download URLs Enable SSRF and Resource Exhaustion
common/file_upload.py:74Unvalidated Signed Upload URL Can Exfiltrate User-Selected Local Files
products/chanjing-credentials-guard/chanjing-credentials-guard-SKILL.md:55Credential Setup Exposes Secrets Through Chat History and Process Arguments
The destination host for this authenticated request is derived from the CHANJING_API_BASE environment variable, so a modified runtime environment can redirect access_token-bearing requests to an attacker-controlled server. Because this module is a routing/upload helper for a skill that handles credentials and media uploads, SSRF-style redirection or credential exfiltration becomes materially more dangerous than a normal configurable endpoint.
"""GET file_detail；API 业务错误返回 (None, msg)，网络异常向上抛出。"""
url = f"{API_BASE}/open/v1/common/file_detail?id={urllib.parse.quote(file_id)}"
req = urllib.request.Request(url, headers={"access_token": token}, method="GET")
with urllib.request.urlopen(req, timeout=30) as resp:
body = json.loads(resp.read().decode("utf-8"))
if body.get("code") != 0:
return None, str(body.get("msg", "file_detail failed"))
This request also uses API_BASE from the environment and sends the access token to whatever host that variable points to. An attacker who can influence environment variables or deployment config could cause the skill to request upload metadata from a malicious endpoint, exposing tokens and potentially returning attacker-controlled sign_url values for subsequent upload steps.
qs = urllib.parse.urlencode({"service": service, "name": name})
url = f"{API_BASE}/open/v1/common/create_upload_url?{qs}"
req = urllib.request.Request(url, headers={"access_token": token}, method="GET")
with urllib.request.urlopen(req, timeout=30) as resp:
body = json.loads(resp.read().decode("utf-8"))
if body.get("code") != 0:
return None, str(body.get("msg", body))
The request URL is built from API_BASE, which is sourced from the CHANJING_API_BASE environment variable without validation or allowlisting. If an attacker can influence the runtime environment, they can redirect authenticated requests to an arbitrary host and capture the access_token header and request payloads, effectively turning this into SSRF plus credential exfiltration. In this skill context, the module is specifically a routing client for privileged Open API calls, so sending bearer-like tokens to an attacker-controlled endpoint is especially dangerous.
url = f"{API_BASE}{path}{suffix}"
req = urllib.request.Request(url, headers={"access_token": token}, method="GET")
try:
with urllib.request.urlopen(req, timeout=timeout) as resp:
body = json.loads(resp.read().decode("utf-8"))
except Exception as exc:
raise SkillHTTPError(str(exc)) from exc
The POST path has the same issue as the GET path: API_BASE comes from an environment variable and is concatenated directly into the destination URL before transmitting the access_token header. A compromised environment or launch configuration could silently reroute authenticated POST requests, exposing tokens and request bodies to an attacker-controlled server. Because this skill manages content-creation operations and credentials, this creates a meaningful exfiltration risk rather than a harmless configurability issue.
method="POST",
)
try:
with urllib.request.urlopen(req, timeout=timeout) as resp:
body = json.loads(resp.read().decode("utf-8"))
except Exception as exc:
raise SkillHTTPError(str(exc)) from exc
The request target is derived from CHANJING_API_BASE and the code sends the access token in an HTTP header to that endpoint. If an attacker can control the environment or execution context, they can redirect requests to an attacker-controlled host and exfiltrate the bearer token and task metadata.
headers={"access_token": token, "Content-Type": "application/json"},
method="POST",
)
with urllib.request.urlopen(req, timeout=60) as resp:
return json.loads(resp.read().decode("utf-8"))
The downloader fetches arbitrary URLs returned by upstream services or embedded in workflow data and writes the response directly to local files with no host restrictions or content validation. This creates an SSRF-style primitive and can be abused to make the agent access internal services or download malicious/unexpected content into the workspace.
def download_url(url: str, dest: Path) -> None:
with DOWNLOAD_SEM:
req = urllib.request.Request(url, method="GET")
with urllib.request.urlopen(req, timeout=300) as resp:
dest.write_bytes(resp.read())
Referenced artifact was not completely inspected
| 顶层入口 | `SKILL.md` | 路由、消歧、契约摘要 |
Referenced artifact was not completely inspected
完整契约见 [`references/top-level-runtime-contract.md`](references/top-level-runtime-contract.md)。
The manifest explicitly permits writing to ${SKILL_DIR}/.env, which is a credential-bearing file location. Even though credentials are declared as environment-based and persistAccessTokenOnDisk is false, allowing writes to a .env file creates a path for accidental secret persistence, overwriting trusted configuration, or planting attacker-controlled values that later influence authentication or API routing.
- "${SKILL_DIR}/"
- user_workflow_and_output_paths
write:
- "${SKILL_DIR}/.env"
- user_output_directory
browser:
mayOpenForAuth: true
Passing the entire parent environment into every subprocess can leak secrets to child programs that do not need them, including ffmpeg/ffprobe and sibling scripts. In this skill context, the pipeline handles credentials and networked tools, so broad environment inheritance increases the blast radius if a child tool is compromised, verbose, or influenced by hostile inputs.
capture_output=True,
text=True,
timeout=timeout,
env={**os.environ, **(env or {})},
)
if r.returncode != 0:
msg = (r.stderr or r.stdout or "").strip() or f"exit {r.returncode}"
The template hard-codes a default China/Chinese-civilization setting and explicitly requires East Asian faces in inferred Chinese contexts unless the user specifies otherwise. In a generative media skill, this is a policy-level bias and unsafe demographic steering issue: it can override user intent, force ethnicity assignment for ambiguous subjects, and systematically produce exclusionary or culturally distorted outputs.
This section mandates an ethnicity default and explicit ethnicity wording without user opt-in, which is a stronger form of sensitive-trait steering than ordinary style guidance. Because the file is a reusable orchestration template, the behavior can systematically affect many generated videos, causing repeated biased outputs, unfair representation, and compliance issues around handling protected characteristics.
The document defaults historical depictions to a Chinese civilizational context and forbids alternative imagery absent contrary evidence, which steers cultural and ethnic representation in a prescriptive way. In a prompt-generation pipeline, this can overwrite ambiguous or multicultural narratives, produce historically inaccurate outputs, and systematically privilege one cultural default without user authorization.
This rule applies a default China-context and East Asian appearance whenever the script does not uniquely determine identity or civilization, embedding protected-attribute and geopolitical assumptions into the generation process. Since this is part of orchestration logic, it can silently bias many outputs and make the skill less trustworthy for general-purpose content creation.
Passing os.environ.copy() into a spawned subprocess forwards all ambient secrets and tokens to child scripts, even though the test appears to need only specific Chanjing credentials. If any called script logs, leaks, or mishandles its environment, unrelated secrets from the parent process could be exposed unnecessarily.
capture_output=True,
text=True,
timeout=timeout,
env=os.environ.copy(),
)
if r.returncode != 0:
raise RuntimeError(
The documentation explicitly directs the skill to read app_id and secret_key from .env, which is direct credential access at the product-skill layer. In an agentic environment, this is high risk because prompt-driven execution paths may cause unnecessary secret exposure, reuse, or leakage through logs, subprocesses, or downstream tooling.
{
"app_id": "<从 .env 的 CHANJING_APP_ID 读取>",
"secret_key": "<从 .env 的 CHANJING_SECRET_KEY 读取>"
}
The secret_key field is specifically called out as being sourced from .env, which exposes a long-lived secret to a lower-trust execution layer. Because this skill orchestrates API calls and scripts, the presence of raw secret-handling instructions increases the chance of accidental disclosure or misuse beyond the centralized router’s intended control.
{
"app_id": "<从 .env 的 CHANJING_APP_ID 读取>",
"secret_key": "<从 .env 的 CHANJING_SECRET_KEY 读取>"
}
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
### Step 2: Branch on result
- **If already configured**: Ask the user—**“You already have Chanjing APP_ID/SECRET_KEY configured. Do you want to re-apply and overwrite the current config?”**
- If the user confirms re-apply, run the “Guide steps” below.
- If the user says no, stop; do not open the login page or show config commands.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## API (chanjing-openapi.yaml)
### Get Access Token
| Item | Value |
|------|--------|
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## API (chanjing-openapi.yaml)
### Get Access Token
| Item | Value |
|------|--------|
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Variable | Description | Default |
|----------|-------------|---------|
| CHANJING_ENV_FILE | Credentials file path | skills/chanjing-content-creation-skill/.env |
| CHANJING_API_BASE | API base URL | https://open-api.chanjing.cc |
## Login and obtaining keys
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Variable | Description | Default |
|----------|-------------|---------|
| CHANJING_ENV_FILE | Credentials file path | skills/chanjing-content-creation-skill/.env |
| CHANJING_API_BASE | API base URL | https://open-api.chanjing.cc |
## Login and obtaining keys
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Variable | Description | Default |
|----------|-------------|---------|
| CHANJING_ENV_FILE | Credentials file path | skills/chanjing-content-creation-skill/.env |
| CHANJING_API_BASE | API base URL | https://open-api.chanjing.cc |
## Login and obtaining keys
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Variable | Description | Default |
|----------|-------------|---------|
| CHANJING_ENV_FILE | Credentials file path | skills/chanjing-content-creation-skill/.env |
| CHANJING_API_BASE | API base URL | https://open-api.chanjing.cc |
## Login and obtaining keys
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Variable | Description | Default |
|----------|-------------|---------|
| CHANJING_ENV_FILE | Credentials file path | skills/chanjing-content-creation-skill/.env |
| CHANJING_API_BASE | API base URL | https://open-api.chanjing.cc |
## Login and obtaining keys