chanjing-one-click-video-creation
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
run_render.pydynamically modifies the Python module search path usingsys.path.insertto import the authentication module from a sibling skill directory (chanjing-tts).- [COMMAND_EXECUTION]: The skill relies onsubprocess.runto execute system binaries likeffmpegandffprobeand call sibling Python scripts (e.g.,create_task.py,poll_task.py) for media processing and task orchestration.- [EXTERNAL_DOWNLOADS]: The skill downloads audio and video assets from vendor-controlled URLs (such asopen-api.chanjing.cc) as part of the video rendering pipeline.- [CREDENTIALS_UNSAFE]: Sensitive authentication data, including API keys and access tokens, are stored and maintained in a local configuration file at~/.chanjing/credentials.json.- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by interpolating user-provided text, such as video topics and scripts, into complex prompt templates for AI video generation without extensive sanitization.
Audit Metadata