中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 0/100
Last scan:2 days ago Rescan
0 /100
chenyu-aigc
Generate AI videos and images via Chenyu Studio AIGC API. Supports text-to-video, image-to-video, video extension, style transfer, and AI image generation.
Documentation-only AI video generation skill that makes direct API calls to the declared Chenyu Studio endpoint using standard CLI tools — no hidden functionality, no exfiltration, no malicious patterns.
Skill Namechenyu-aigc
Duration26.5s
Enginepi
✓
Safe to install
Approve for use. The skill is a pure-document skill with no executable code; all shell usage (curl, jq, uuidgen, base64) is declared and serves a single, documented purpose: orchestrating AI video/image generation via the Chenyu API.

Findings 1 items

Severity Finding Location
Low
Undeclared filesystem:WRITE for temp file writes
execute-recipe.md instructs the agent to write JSON payloads to /tmp/payload.json when handling large base64 data URIs, but SKILL.md metadata does not declare filesystem:WRITE access. This is a minor documentation gap, not a security violation.
cat > /tmp/payload.json <<EOF
{
  "inputs": [...]
}
EOF
→ Add 'filesystem:WRITE' to the metadata requires.env entry or document the /tmp usage in the description. Since the file is always local /tmp, the blast radius is minimal.
 execute-recipe.md:66
ResourceDeclaredInferredStatusEvidence
Network READ READ ✓ Aligned SKILL.md:48 — all curl calls target the declared $CHENYU_BASE_URL
Shell WRITE WRITE ✓ Aligned SKILL.md:9-10 — declares curl, jq, uuidgen, base64 as required binaries
Environment READ READ ✓ Aligned SKILL.md:11 — CHENYU_API_KEY and CHENYU_BASE_URL used for auth and config only
Filesystem NONE WRITE ✓ Aligned execute-recipe.md:66 — writes /tmp/payload.json for large JSON bodies; not decla…
Clipboard NONE NONE —
Browser NONE NONE —
Database NONE NONE —
Skill Invoke NONE NONE —
1 findings
🔗
Medium External URL 外部 URL
https://chenyu.pro
SKILL.md:52

File Tree

3 files · 9.2 KB · 287 lines
Markdown 3f · 287L
├─ 📝 execute-recipe.md Markdown 146L · 4.6 KB
├─ 📝 manage-tasks.md Markdown 56L · 1.8 KB
└─ 📝 SKILL.md Markdown 85L · 2.7 KB

Security Positives

✓ No executable code — this is a documentation-only skill with zero attack surface from code execution
✓ All network traffic is to the single, clearly declared Chenyu Studio API endpoint (https://chenyu.pro)
✓ No credential exfiltration — CHENYU_API_KEY is used exclusively for Bearer-token auth to the declared API
✓ No base64 obfuscation — base64 is used only for converting local image files to data URIs, which is documented and necessary
✓ No subprocess chain abuse or command injection vectors
✓ No access to sensitive local paths (~/.ssh, ~/.aws, .env, etc.)
✓ No download-and-execute patterns (curl|bash, wget|sh)
✓ No hidden HTML content, obfuscated strings, or steganographic payloads
✓ All shell commands are declared as required binaries (curl, jq, uuidgen, base64)
✓ Idempotency-Key header prevents accidental duplicate task submissions