ClawHub
Back to skill

Security audit

Zyt video compose

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for Chanjing video generation, but it handles API secrets and cached tokens in local plaintext files without strong permission controls.

Review this skill before installing if you use Chanjing credentials on a shared machine. Store ~/.chanjing/credentials.json with owner-only permissions, consider using a dedicated low-privilege API key, and confirm before uploading local audio or background files because they will be sent to Chanjing for processing.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/_auth.py:50
Finding

Credential file permissions are not explicitly restricted

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The skill explicitly instructs scripts to read credentials from a fixed local file location, which involves direct access to sensitive AK/SK material. In an agent environment, credential-file access is dangerous because a compromised or overly broad skill can expose, misuse, or retain secrets beyond the intended API call flow.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
本 Skill 使用：

* 配置文件：`~/.chanjing/credentials.json`
* 若设置环境变量 `CHANJING_CONFIG_DIR`：使用 `$CHANJING_CONFIG_DIR/credentials.json`
* API 基础地址固定：`https://open-api.chanjing.cc`

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

Allowing credential-path override through CHANJING_CONFIG_DIR expands the trust boundary to environment-controlled locations, increasing the chance of secret confusion, accidental exposure, or use of attacker-influenced credentials. In shared or automated environments, env-based path redirection can be abused to point the skill at unintended secret files.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
本 Skill 使用：

* 配置文件：`~/.chanjing/credentials.json`
* 若设置环境变量 `CHANJING_CONFIG_DIR`：使用 `$CHANJING_CONFIG_DIR/credentials.json`
* API 基础地址固定：`https://open-api.chanjing.cc`

当本地缺少 AK/SK 或 AK/SK 无效时，脚本默认返回登录引导信息，不自动打开浏览器。

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 1)May include surrounding context.

python
# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；默认不自动打开浏览器，仅返回登录引导信息
import json
import os

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 10)May include surrounding context.

python
# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；默认不自动打开浏览器，仅返回登录引导信息
import json
import os

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 17)May include surrounding context.

python
# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；默认不自动打开浏览器，仅返回登录引导信息
import json
import os

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 26)May include surrounding context.

python
# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；默认不自动打开浏览器，仅返回登录引导信息
import json
import os

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 27)May include surrounding context.

python
# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；默认不自动打开浏览器，仅返回登录引导信息
import json
import os

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill describes capabilities that read environment variables, access local credential files, write output files, and make network requests, but it declares no explicit tool scope or permission boundaries. This weakens least-privilege controls and makes it harder for a host agent to constrain what the skill may access at runtime.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: chanjing-video-compose
description: Use Chanjing video synthesis APIs to create digital human videos from text or audio, with optional background upload, task polling, and explicit download when the user asks to save the result locally.
metadata:
  openclaw:
    homepage: https://open-api.chanjing.cc

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The markdown directs the agent to default to youthful, energetic personas when the user has no special requirement. This is a natural-language policy concern because it hard-codes a stylistic demographic preference rather than leaving the choice to the user or presenting neutral options.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The examples explicitly demonstrate uploading local audio/background files to a third-party video synthesis service and downloading generated output to the local machine, but provide no warning, consent language, or constraints around data transfer and local file effects. In an agent setting, this can normalize sending potentially sensitive local content off-device and writing files locally without making the user aware of privacy, data handling, or overwrite/storage implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Both minimum request-body examples hardcode "language": "cn", and the surrounding reference does not indicate that language should be selected based on user preference or that other locales are supported. This is a natural-language policy issue because it steers usage toward a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The code writes authentication material and cached token data into credentials.json, which affects sensitive user data on disk. While the file comments mention reading credentials, there is no user-facing warning, confirmation, or explanatory log around persisting access_token and expire_in locally.

Content

No source excerpt is available for this finding.

Tainted flow: 'CONFIG_FILE' from os.environ.get (line 10, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/_auth.py (reported line 52)May include surrounding context.

python
def write_config(data):
    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
        json.dump(data, f, indent=2, ensure_ascii=False)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This function sends app_id and secret_key to a remote API endpoint to obtain an access token, which is a safety-relevant transmission of credentials. The file lacks a visible warning, log, or explanatory docstring near the request to disclose that local credentials are sent over the network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. The file presents all natural-language trigger phrases solely in Chinese and does not indicate that other languages are supported or that Chinese is an intentional, user-selected constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file explains uploading local audio/background files and downloading generated video results, but it does not include an explicit user-facing warning that these actions transmit user content to remote services and may save outputs locally. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors affecting user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file comments and user-facing error/help messages are written only in Chinese, including guidance shown when credentials are missing or invalid. This imposes a specific language on users without any opt-in or alternative locale handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.