chanjing-one-click-video-creation

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script run_render.py dynamically modifies the Python module search path using sys.path.insert to import the authentication module from a sibling skill directory (chanjing-tts).- [COMMAND_EXECUTION]: The skill relies on subprocess.run to execute system binaries like ffmpeg and ffprobe and call sibling Python scripts (e.g., create_task.py, poll_task.py) for media processing and task orchestration.- [EXTERNAL_DOWNLOADS]: The skill downloads audio and video assets from vendor-controlled URLs (such as open-api.chanjing.cc) as part of the video rendering pipeline.- [CREDENTIALS_UNSAFE]: Sensitive authentication data, including API keys and access tokens, are stored and maintained in a local configuration file at ~/.chanjing/credentials.json.- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by interpolating user-provided text, such as video topics and scripts, into complex prompt templates for AI video generation without extensive sanitization.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 07:07 AM