ClawHub
Back to skill

Security audit

Zyt text to digital person

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Chanjing API helper that uses local Chanjing credentials and writes only expected local configuration or explicitly requested generated outputs.

Install only if you intend to use Chanjing's API and are comfortable storing Chanjing app_id, secret_key, and cached access tokens locally. Treat generated portrait/video outputs as potentially sensitive personal media, and only ask the agent to download them when you want files saved under the documented outputs directory.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

The skill explicitly instructs runtime code to read credentials from a local file in the user's home directory. Accessing local secrets is expected for API authentication, but without tighter scoping and handling guarantees it creates a path for credential exposure, misuse, or accidental disclosure through logs or downstream tooling.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
本 Skill 使用：

* 配置文件：`~/.chanjing/credentials.json`
* 若设置环境变量 `CHANJING_CONFIG_DIR`：使用 `$CHANJING_CONFIG_DIR/credentials.json`
* API 基础地址固定：`https://open-api.chanjing.cc`

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

The alternate path using CHANJING_CONFIG_DIR allows the skill to read credentials from an environment-controlled directory. While useful for configuration, this broadens the secret access surface because a manipulated environment can redirect the skill to unexpected files containing sensitive material.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
本 Skill 使用：

* 配置文件：`~/.chanjing/credentials.json`
* 若设置环境变量 `CHANJING_CONFIG_DIR`：使用 `$CHANJING_CONFIG_DIR/credentials.json`
* API 基础地址固定：`https://open-api.chanjing.cc`

当本地缺少 AK/SK 或 AK/SK 无效时，脚本默认返回登录引导信息，不自动打开浏览器。

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 9)May include surrounding context.

python
from pathlib import Path

CONFIG_DIR = Path(os.environ.get("CHANJING_CONFIG_DIR", Path.home() / ".chanjing"))
CONFIG_FILE = CONFIG_DIR / "credentials.json"
API_BASE = "https://open-api.chanjing.cc"
BUFFER_SECONDS = 300
LOGIN_URL = "https://www.chanjing.cc/openapi/login"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 16)May include surrounding context.

python
from pathlib import Path

CONFIG_DIR = Path(os.environ.get("CHANJING_CONFIG_DIR", Path.home() / ".chanjing"))
CONFIG_FILE = CONFIG_DIR / "credentials.json"
API_BASE = "https://open-api.chanjing.cc"
BUFFER_SECONDS = 300
LOGIN_URL = "https://www.chanjing.cc/openapi/login"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 25)May include surrounding context.

python
from pathlib import Path

CONFIG_DIR = Path(os.environ.get("CHANJING_CONFIG_DIR", Path.home() / ".chanjing"))
CONFIG_FILE = CONFIG_DIR / "credentials.json"
API_BASE = "https://open-api.chanjing.cc"
BUFFER_SECONDS = 300
LOGIN_URL = "https://www.chanjing.cc/openapi/login"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 26)May include surrounding context.

python
from pathlib import Path

CONFIG_DIR = Path(os.environ.get("CHANJING_CONFIG_DIR", Path.home() / ".chanjing"))
CONFIG_FILE = CONFIG_DIR / "credentials.json"
API_BASE = "https://open-api.chanjing.cc"
BUFFER_SECONDS = 300
LOGIN_URL = "https://www.chanjing.cc/openapi/login"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises scripts that read environment variables and local credential files, perform network requests, write output files, and invoke shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. That makes the operational trust boundary unclear and increases the chance an agent executes higher-privilege actions than a reviewer or runtime expects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: chanjing-text-to-digital-person
description: Use Chanjing text-to-digital-person APIs to create AI portrait images, turn them into talking videos, optionally run LoRA training, poll async tasks, and explicitly download generated assets when requested.
metadata:
  openclaw:
    requires:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases are broad and framed as actions the skill 'should' handle, but they do not define boundaries, preconditions, or explicit exclusions. In an agent setting, this can cause over-activation for loosely related user requests and lead to unintended API calls, task creation, or downstream file operations without sufficient user confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The examples instruct downloading generated files to the local machine and state that the script outputs a local file path, but they provide no warning that the operation writes to disk or that the URL should be validated before retrieval. In an autonomous agent context, this increases the risk of unexpected local file writes, unsafe fetching of untrusted remote content, and user surprise about persistence of downloaded assets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file content is entirely presented in Chinese, including operational instructions and field descriptions, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation explicitly maps a download_result script to downloading output_url assets to local storage, but it provides no warning about local file writes, persistence, overwrite behavior, storage location, or handling of potentially sensitive generated media. In this skill context, the downloaded assets are user-generated images/videos that may contain personal likenesses, so silent persistence increases privacy and data-handling risk even if it is not an exploit by itself.

Content

No source excerpt is available for this finding.

Tainted flow: 'CONFIG_FILE' from os.environ.get (line 9, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/_auth.py (reported line 54)May include surrounding context.

python
os.chmod(CONFIG_DIR, 0o700)
    except Exception:
        pass
    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
        json.dump(data, f, indent=2, ensure_ascii=False)
    try:
        os.chmod(CONFIG_FILE, 0o600)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The function sends app_id and secret_key to a remote API endpoint, which is a safety-relevant network operation involving credentials. There is no confirmation prompt, logging, comment, or docstring in this file disclosing that local credentials will be transmitted to https://open-api.chanjing.cc to obtain a token.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

When CHANJING_AUTO_OPEN_LOGIN is enabled, the code launches the browser via webbrowser.open(LOGIN_URL). This is an external side effect, but the function performs it silently with no prompt, print, or explanatory comment to inform the user that the browser may be opened automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.