chanjing-one-click-video-creation
Pass
Audited by Gen Agent Trust Hub on Mar 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/run_render.pyutilizessubprocess.runto execute local binaries likeffmpegandffprobe, as well as Python scripts from sibling skill directories (chanjing-tts,chanjing-video-compose,chanjing-ai-creation). This is fundamental to the video rendering and orchestration logic.\n- [EXTERNAL_DOWNLOADS]: The skill performs network requests usingurllib.requestto communicate with the vendor's API athttps://open-api.chanjing.ccfor downloading media content and managing synthesis tasks. These are official vendor endpoints.\n- [PROMPT_INJECTION]: The skill ingests untrusted user input fromworkflow.json(such asfull_scriptandscenes) and interpolates it into prompts for video and audio generation services. 1. Ingestion points: User-provided workflow and script data inworkflow.json. 2. Boundary markers: None identified in the prompt construction logic. 3. Capability inventory: Execution of sub-processes (ffmpeg) and network communications. 4. Sanitization: Basic whitespace normalization is applied via thenorm_textfunction.\n- [REMOTE_CODE_EXECUTION]: The scriptscripts/run_render.pydynamically modifies the Python path at runtime to import an authentication module (_auth.py) from a sibling skill directory, which constitutes dynamic loading from computed paths.
Audit Metadata