The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/_auth.py to optionally invoke a sibling script (open_login_page.py) for authentication purposes. This is a local execution of a known internal script to help the user configure credentials and is considered safe within the intended workflow.
[DATA_EXPOSURE]: The skill manages sensitive API credentials (app_id, secret_key, access_token) within a dedicated configuration directory (default ~/.chanjing). This follows secure local storage practices by keeping secrets in a specific configuration file (credentials.json) and is documented in the manifest's credentials section.
[REMOTE_CODE_EXECUTION]: Static analysis identified subprocess.run calls, but these are restricted to executing specific, locally-shipped Python scripts for authentication. There are no patterns involving the download and execution of untrusted remote code.
[EXTERNAL_DOWNLOADS]: Network operations are performed using urllib.request to communicate with the official open-api.chanjing.cc host. These connections are strictly for API interaction and token management as defined in the skill's purpose.

chanjing-openapi-tools