ClawHub
Back to skill

Security audit

Chanjing Customised Person

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chanjing API helper that uses local credentials, uploads user-selected videos, and can delete Chanjing resources, with risks that are expected for its purpose.

Install only if you trust this Chanjing integration. Keep ~/.chanjing/credentials.json private with restrictive permissions, upload only videos you intend to send to Chanjing, use --callback only with endpoints you control, and double-check IDs before running delete commands.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Credential Access

High
Category
Privilege Escalation
Content
requires_ffmpeg: false
requires_ffprobe: false
notes: >-
  Reads ~/.chanjing/credentials.json; may open browser if AK/SK missing.
  Upload path: GET create_upload_url then HTTPS PUT to API-returned sign_url
  (host may differ from open-api). Optional --callback URL may receive sensitive
  POST payloads from Chanjing.
Confidence
82% confidence
Finding
The skill documents two behaviors that increase exposure: it may open a browser automatically when credentials are missing, and it uploads content to an API-returned sign_url whose host may differ from the primary API domain. Most importantly, the optional callback can cause sensitive task payloads to be POSTed to an arbitrary user-supplied endpoint, which creates a real data-exfiltration and trust-boundary risk if misused or configured unsafely.

Credential Access

High
Category
Privilege Escalation
Content
与 **Purpose / Credentials / Persistence / Network** 相关的逐项说明见 **`manifest.yaml`**（含 **`permissions.network_mode: open`** 与 **`signUrlPutNote`**）。以下仅 **SKILL 正文补充**：

- **`credentials.json`**：脚本会读取本地凭据；刷新后的 **`access_token` / `expire_in` 写回同一文件**为**预期行为**。须限制目录/文件权限（如目录 `0700`、文件 `0600`），并**确保永不提交版本库**（见 manifest **`doNotCommitToVcs`**）。
- **`sign_url` 与 PUT 主机**：`upload_file.py` / `get_upload_url.py` 先请求 `open-api.chanjing.cc` 的 `create_upload_url`，再向响应中的 **`sign_url` 发起 HTTPS PUT**；该 URL 的主机常为蝉镜侧对象存储或 CDN，**可能不在**固定主机白名单中，清单中已改为 **`network_mode: open`** 以如实声明。
- **`create_person.py --callback`**：若传入 URL，远程服务可能向该端点 **POST** 任务结果，载荷可能含状态与资源引用等**敏感信息**；须自行信任该端点并承担出站与数据暴露风险。
- **本地视频**：仅按用户给出的路径读取视频字节并上传到 API 指定端点；不扫描其它无关系统路径。
Confidence
95% confidence
Finding
This section confirms that refreshed access tokens are written back to disk, uploads are sent to API-provided sign_url hosts outside a fixed allowlist under network_mode: open, and callback URLs may receive sensitive payloads. These are real security-relevant behaviors because they expand the trust boundary, permit outbound transmission to variable destinations, and can leak sensitive task metadata or resources if a malicious or mistaken endpoint is supplied.

Credential Access

High
Category
Privilege Escalation
Content
persistAccessTokenOnDisk: true
  primaryEnvIntentionallyOmitted: true
  doNotCommitToVcs:
    - credentials.json
  persistNote: >-
    access_token 与 expire_in 刷新后写回 credentials.json 为预期行为；须限制文件权限（如 0600/目录 0700）
    并确保永不提交版本库。
Confidence
83% confidence
Finding
Persisting refreshed access_token material to disk increases the exposure window if the workspace, home directory, or agent environment is compromised. In this skill, the risk is amplified by declared write access to the credential store and open network usage elsewhere in the manifest, so stolen tokens could enable unauthorized API access until expiry or rotation.

Credential Access

High
Category
Privilege Escalation
Content
- "${CHANJING_OPENAPI_CREDENTIALS_DIR or CHANJING_CONFIG_DIR or ~/.chanjing}/credentials.json"
      - user_provided_video_paths
    write:
      - "${CHANJING_OPENAPI_CREDENTIALS_DIR or CHANJING_CONFIG_DIR or ~/.chanjing}/credentials.json"
  browser:
    mayOpenForAuth: true
    documentedHosts:
Confidence
79% confidence
Finding
Granting filesystem write access to credentials.json creates a tampering and persistence surface: compromised or buggy skill code could overwrite credentials, replace tokens, or poison future authentication state. In this context the risk is more meaningful because the manifest explicitly allows token persistence on disk, so write access can alter durable secret-bearing state rather than only transient data.

Static analysis

No suspicious patterns detected.