jianying-editor

Warn

Audited by Gen Agent Trust Hub on Apr 12, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: Multiple components use the subprocess module to execute system binaries and internal scripts.
  • scripts/jy_wrapper.py and scripts/video_analyzer.py call ffmpeg and ffprobe for media processing and metadata extraction.
  • tools/check_repo_hygiene.py executes git commands to verify tracked files.
  • scripts/api_validator.py executes other internal Python scripts using sys.executable to perform diagnostics.
  • [DATA_EXFILTRATION]: The skill accesses sensitive local application data to facilitate API authentication.
  • scripts/universal_tts.py and scripts/list_tts_speakers.py read local configuration files like TTNet\tt_net_config.config and application logs to harvest device_id and iid parameters for the ByteDance SAMI TTS API.
  • [EXTERNAL_DOWNLOADS]: Fetches media content from remote servers during runtime.
  • scripts/cloud_manager.py downloads video and audio assets from ByteDance content delivery domains (e.g., vlabvod.com).
  • The logic includes a safety check (_is_safe_download_url) intended to prevent requests to localhost or private network IP addresses.
  • [REMOTE_CODE_EXECUTION]: The skill provides several surfaces for executing code or processing complex remote inputs.
  • scripts/core/windows_export_agent.py starts a FastAPI web server on port 8765 that allows remote systems to trigger export tasks and move files on the local filesystem without authentication.
  • scripts/web_recorder.py utilizes the Playwright library to launch a headless Chromium instance and execute arbitrary Javascript code provided in HTML templates to record visual effects.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 12, 2026, 06:23 PM