chanjing-tts
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
_auth.pyscript invokes a local helper script from a related vendor skill (chanjing-credentials-guard) usingsubprocess.run. This is used to trigger a login page in the user's browser when API credentials are not found. The execution uses a hardcoded path relative to the skill and utilizessys.executablerather than a shell, which is a secure implementation pattern. - [SAFE]: The skill interacts exclusively with official vendor domains (
open-api.chanjing.cc) for authentication and task management. Sensitive data like theapp_idandsecret_keyare managed via a dedicated local configuration file (~/.chanjing/credentials.json) which is standard practice for this vendor's ecosystem.
Audit Metadata