chanjing-video-translation
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.run()to invoke a local scriptchanjing-credentials-guard/scripts/open_login_page.py. This is part of the established auth flow between sibling skills from the same vendor and uses a fixed path with the system python interpreter, mitigating command injection risks. - [CREDENTIALS_SAFE]: The skill manages sensitive API keys (
app_id,secret_key) and access tokens using a localcredentials.jsonfile. It follows best practices by storing these in the user's home directory (~/.chanjing), providing explicit configuration for filesystem permissions in the manifest, and including instructions to avoid committing these secrets to version control. - [EXTERNAL_DOWNLOADS]: Network operations are restricted to the vendor's official API domains (
open-api.chanjing.cc) and authentication pages (www.chanjing.cc). These are documented in the manifest's allowlist. - [DATA_EXPOSURE]: Data transmission is limited to sending video metadata and translation parameters to the official Chanjing API over HTTPS. No unauthorized data exfiltration patterns were detected.
Audit Metadata