Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its Chanjing digital-human API purpose, but it can upload personal source videos and delete account assets without clear confirmation safeguards.
Review before installing if the agent may handle real-person videos or production Chanjing assets. Only upload videos you have rights and consent to process, keep the credentials file protected, and require an explicit confirmation with the exact person_id before any delete_person operation.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from pathlib import Path
CONFIG_DIR = Path(os.environ.get("CHANJING_CONFIG_DIR", Path.home() / ".chanjing"))
CONFIG_FILE = CONFIG_DIR / "credentials.json"
API_BASE = "https://open-api.chanjing.cc"
BUFFER_SECONDS = 300
LOGIN_URL = "https://www.chanjing.cc/openapi/login"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from pathlib import Path
CONFIG_DIR = Path(os.environ.get("CHANJING_CONFIG_DIR", Path.home() / ".chanjing"))
CONFIG_FILE = CONFIG_DIR / "credentials.json"
API_BASE = "https://open-api.chanjing.cc"
BUFFER_SECONDS = 300
LOGIN_URL = "https://www.chanjing.cc/openapi/login"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from pathlib import Path
CONFIG_DIR = Path(os.environ.get("CHANJING_CONFIG_DIR", Path.home() / ".chanjing"))
CONFIG_FILE = CONFIG_DIR / "credentials.json"
API_BASE = "https://open-api.chanjing.cc"
BUFFER_SECONDS = 300
LOGIN_URL = "https://www.chanjing.cc/openapi/login"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from pathlib import Path
CONFIG_DIR = Path(os.environ.get("CHANJING_CONFIG_DIR", Path.home() / ".chanjing"))
CONFIG_FILE = CONFIG_DIR / "credentials.json"
API_BASE = "https://open-api.chanjing.cc"
BUFFER_SECONDS = 300
LOGIN_URL = "https://www.chanjing.cc/openapi/login"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from pathlib import Path
CONFIG_DIR = Path(os.environ.get("CHANJING_CONFIG_DIR", Path.home() / ".chanjing"))
CONFIG_FILE = CONFIG_DIR / "credentials.json"
API_BASE = "https://open-api.chanjing.cc"
BUFFER_SECONDS = 300
LOGIN_URL = "https://www.chanjing.cc/openapi/login"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
from pathlib import Path
CONFIG_DIR = Path(os.environ.get("CHANJING_CONFIG_DIR", Path.home() / ".chanjing"))
CONFIG_FILE = CONFIG_DIR / "credentials.json"
API_BASE = "https://open-api.chanjing.cc"
BUFFER_SECONDS = 300
LOGIN_URL = "https://www.chanjing.cc/openapi/login"
The skill documents and relies on capabilities including environment-variable access, local file read/write, network access, and shell execution, but it does not declare any explicit tool scope or permissions boundary. That omission increases the chance an agent will invoke powerful operations without clear policy constraints or user visibility, especially because the skill also handles local credentials and destructive actions.
The operative 'When to Use This Skill' guidance is presented only in Chinese, which imposes a specific language context without offering user choice or documenting a justified locale restriction. This can violate language/locale policy when no opt-in or explicit regional limitation is provided.
The skill explicitly supports deleting custom digital humans but provides no instruction to confirm user intent before performing the destructive action. In an agent setting, this can lead to accidental or ambiguous-resource deletion if the agent infers intent too aggressively or acts on incomplete context.
The example shows a delete command as a normal workflow step without any warning banner, confirmation prompt, or note that the action is irreversible. Examples strongly influence agent behavior, so presenting deletion as routine increases the risk of unsafe execution against production resources.
The trigger phrases are broad and action-oriented, covering upload, creation, polling, listing, and deletion without stating confirmation requirements, authorization boundaries, or when the skill should not activate. In an agent setting, this increases the chance of unintended execution of sensitive or destructive operations, especially deletion or media upload, from loosely matched user requests.
The examples demonstrate uploading source videos and deleting custom digital humans but provide no warning about data sensitivity, privacy implications, irreversible deletion, or the need for user consent. Because this skill handles user media and destructive operations, omission of these safeguards can lead to accidental disclosure, unauthorized processing of biometric-like content, or unintended data loss.
This markdown file documents the delete_customised_person operation and its request body, but it does not warn that the action deletes a customised person and may be irreversible. For markdown files, safety-impacting behaviors that can affect user data or system integrity should include explicit user-facing warnings.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
os.chmod(CONFIG_DIR, 0o700)
except Exception:
pass
with open(CONFIG_FILE, "w", encoding="utf-8") as f:
json.dump(data, f, indent=2, ensure_ascii=False)
try:
os.chmod(CONFIG_FILE, 0o600)
The function sends app_id and secret_key to a remote API via urllib.request.urlopen, which is a safety-relevant network transmission of credentials. In this code file there is no confirmation prompt, logging, comment, or docstring warning the user that local credentials will be sent to an external service.
The natural-language trigger examples and surrounding instructions are presented only in Chinese, which implies a language-specific interaction model without stating that this is optional or region-specific. The policy allows locale constraints when clearly documented and justified, but that justification is absent here.
The file presents all operational guidance in Chinese, with no indication that users may choose another language or that the locale restriction is intentional and documented. The policy requires avoiding language or locale constraints unless there is explicit opt-in or a justified region-specific limitation.
The only user-visible guidance strings in this file are Chinese-language messages for missing or invalid credentials. This enforces a specific language without any opt-in or fallback, which is a natural-language locale policy concern.
No suspicious patterns detected.