jianying-editor
Warn
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Multiple components use the
subprocessmodule to execute system binaries and internal scripts. scripts/jy_wrapper.pyandscripts/video_analyzer.pycallffmpegandffprobefor media processing and metadata extraction.tools/check_repo_hygiene.pyexecutesgitcommands to verify tracked files.scripts/api_validator.pyexecutes other internal Python scripts usingsys.executableto perform diagnostics.- [DATA_EXFILTRATION]: The skill accesses sensitive local application data to facilitate API authentication.
scripts/universal_tts.pyandscripts/list_tts_speakers.pyread local configuration files likeTTNet\tt_net_config.configand application logs to harvestdevice_idandiidparameters for the ByteDance SAMI TTS API.- [EXTERNAL_DOWNLOADS]: Fetches media content from remote servers during runtime.
scripts/cloud_manager.pydownloads video and audio assets from ByteDance content delivery domains (e.g.,vlabvod.com).- The logic includes a safety check (
_is_safe_download_url) intended to prevent requests to localhost or private network IP addresses. - [REMOTE_CODE_EXECUTION]: The skill provides several surfaces for executing code or processing complex remote inputs.
scripts/core/windows_export_agent.pystarts a FastAPI web server on port 8765 that allows remote systems to trigger export tasks and move files on the local filesystem without authentication.scripts/web_recorder.pyutilizes the Playwright library to launch a headless Chromium instance and execute arbitrary Javascript code provided in HTML templates to record visual effects.
Audit Metadata