Zyt credentials guard

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:30 PM UTC
• Version:
  0.5.0

Overview

This is a documentation-only Chanjing credential setup guide with disclosed local credential handling and no hidden executable behavior.

Install only if you intend to manage Chanjing API credentials locally. Keep ~/.chanjing/credentials.json private, avoid committing or sharing it, verify the Chanjing API domain before token refresh, and rotate keys if they are ever pasted into chat or exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly describes where long-lived credentials and access tokens are stored on disk, including the exact JSON fields and default path, but provides no guidance on file permissions, redaction, logging hygiene, or avoiding accidental disclosure. In a credential-handling skill, this omission increases the chance users will store, copy, or expose sensitive keys insecurely, making credential theft or unauthorized API access more likely.

VirusTotal

60/60 vendors flagged this skill as clean.