chanjing-one-click-video-creation

Pass

Audited by Gen Agent Trust Hub on Mar 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/run_render.py utilizes subprocess.run to execute local binaries like ffmpeg and ffprobe, as well as Python scripts from sibling skill directories (chanjing-tts, chanjing-video-compose, chanjing-ai-creation). This is fundamental to the video rendering and orchestration logic.\n- [EXTERNAL_DOWNLOADS]: The skill performs network requests using urllib.request to communicate with the vendor's API at https://open-api.chanjing.cc for downloading media content and managing synthesis tasks. These are official vendor endpoints.\n- [PROMPT_INJECTION]: The skill ingests untrusted user input from workflow.json (such as full_script and scenes) and interpolates it into prompts for video and audio generation services. 1. Ingestion points: User-provided workflow and script data in workflow.json. 2. Boundary markers: None identified in the prompt construction logic. 3. Capability inventory: Execution of sub-processes (ffmpeg) and network communications. 4. Sanitization: Basic whitespace normalization is applied via the norm_text function.\n- [REMOTE_CODE_EXECUTION]: The script scripts/run_render.py dynamically modifies the Python path at runtime to import an authentication module (_auth.py) from a sibling skill directory, which constitutes dynamic loading from computed paths.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 27, 2026, 07:35 PM