ClawHub
Back to skill

Security audit

Chanjing Tts Voice Clone

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says: use Chanjing's TTS service, while openly relying on local Chanjing credentials and external API calls.

Install this only if you intend to connect a Chanjing account. Keep ~/.chanjing/credentials.json private, do not commit it to version control, use only voice material and text you are allowed to send to Chanjing, and avoid setting CHANJING_API_BASE unless you deliberately trust the replacement API endpoint.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tainted flow: 'CONFIG_FILE' from os.environ.get (line 12, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
def write_config(data):
    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
        json.dump(data, f, indent=2, ensure_ascii=False)
Confidence
83% confidence
Finding
with open(CONFIG_FILE, "w", encoding="utf-8") as f:

Tainted flow: 'req' from os.environ.get (line 75, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            body = json.loads(resp.read().decode("utf-8"))
    except Exception as e:
        return None, str(e)
Confidence
97% confidence
Finding
with urllib.request.urlopen(req, timeout=30) as resp:

Missing User Warnings

Medium
Confidence
80% confidence
Finding
This code automatically sends app_id and secret_key over the network to obtain an access token, but there is no user-facing disclosure at the point of transmission. In this skill context, credentials are expected, yet silent transmission increases the risk of users misunderstanding when sensitive data leaves the machine, especially since the endpoint can be overridden by environment variable.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.