ClawHub
Back to skill

Security audit

Chanjing Customised Person

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Chanjing API helper that uses local credentials, uploads user-selected videos, and can delete Chanjing resources, with risks that are expected for its purpose.

Install only if you trust this Chanjing integration. Keep ~/.chanjing/credentials.json private with restrictive permissions, upload only videos you intend to send to Chanjing, use --callback only with endpoints you control, and double-check IDs before running delete commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Credential Access

High
Category
Privilege Escalation
Content
requires_ffmpeg: false
requires_ffprobe: false
notes: >-
  Reads ~/.chanjing/credentials.json; may open browser if AK/SK missing.
  Upload path: GET create_upload_url then HTTPS PUT to API-returned sign_url
  (host may differ from open-api). Optional --callback URL may receive sensitive
  POST payloads from Chanjing.
Confidence
82% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
与 **Purpose / Credentials / Persistence / Network** 相关的逐项说明见 **`manifest.yaml`**（含 **`permissions.network_mode: open`** 与 **`signUrlPutNote`**）。以下仅 **SKILL 正文补充**：

- **`credentials.json`**：脚本会读取本地凭据；刷新后的 **`access_token` / `expire_in` 写回同一文件**为**预期行为**。须限制目录/文件权限（如目录 `0700`、文件 `0600`），并**确保永不提交版本库**（见 manifest **`doNotCommitToVcs`**）。
- **`sign_url` 与 PUT 主机**：`upload_file.py` / `get_upload_url.py` 先请求 `open-api.chanjing.cc` 的 `create_upload_url`，再向响应中的 **`sign_url` 发起 HTTPS PUT**；该 URL 的主机常为蝉镜侧对象存储或 CDN，**可能不在**固定主机白名单中，清单中已改为 **`network_mode: open`** 以如实声明。
- **`create_person.py --callback`**：若传入 URL，远程服务可能向该端点 **POST** 任务结果，载荷可能含状态与资源引用等**敏感信息**；须自行信任该端点并承担出站与数据暴露风险。
- **本地视频**：仅按用户给出的路径读取视频字节并上传到 API 指定端点；不扫描其它无关系统路径。
Confidence
95% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
persistAccessTokenOnDisk: true
  primaryEnvIntentionallyOmitted: true
  doNotCommitToVcs:
    - credentials.json
  persistNote: >-
    access_token 与 expire_in 刷新后写回 credentials.json 为预期行为；须限制文件权限（如 0600/目录 0700）
    并确保永不提交版本库。
Confidence
83% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
- "${CHANJING_OPENAPI_CREDENTIALS_DIR or CHANJING_CONFIG_DIR or ~/.chanjing}/credentials.json"
      - user_provided_video_paths
    write:
      - "${CHANJING_OPENAPI_CREDENTIALS_DIR or CHANJING_CONFIG_DIR or ~/.chanjing}/credentials.json"
  browser:
    mayOpenForAuth: true
    documentedHosts:
Confidence
79% confidence
Finding
credentials.json

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.