ClawHub
Back to skill

Security audit

Chanjing Tts Voice Clone

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: use Chanjing's TTS service, while openly relying on local Chanjing credentials and external API calls.

Install this only if you intend to connect a Chanjing account. Keep ~/.chanjing/credentials.json private, do not commit it to version control, use only voice material and text you are allowed to send to Chanjing, and avoid setting CHANJING_API_BASE unless you deliberately trust the replacement API endpoint.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tainted flow: 'CONFIG_FILE' from os.environ.get (line 12, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
def write_config(data):
    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
        json.dump(data, f, indent=2, ensure_ascii=False)
Confidence
83% confidence
Finding
CONFIG_FILE is derived from the CHANJING_CONFIG_DIR environment variable and then written without validation. If an attacker can influence the environment in which the skill runs, they can redirect credential writes to an arbitrary filesystem location, potentially overwriting user files or storing secrets in an unsafe path.

Tainted flow: 'req' from os.environ.get (line 75, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            body = json.loads(resp.read().decode("utf-8"))
    except Exception as e:
        return None, str(e)
Confidence
97% confidence
Finding
The request target is built from CHANJING_API_BASE, an environment-controlled value, and the POST body contains app_id and secret_key. If that environment variable is tampered with, the code will send credentials to an attacker-controlled server, directly enabling credential exfiltration.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
This code automatically sends app_id and secret_key over the network to obtain an access token, but there is no user-facing disclosure at the point of transmission. In this skill context, credentials are expected, yet silent transmission increases the risk of users misunderstanding when sensitive data leaves the machine, especially since the endpoint can be overridden by environment variable.

Static analysis

No suspicious patterns detected.