Security audit

3d-generator

Security checks for vulnerabilities and agentic risk

Overview

The skill’s 3D-generation purpose is coherent, but users should review it because it documents unpinned npx command execution while using an API key and sends prompts or image URLs to external services.

Install only if you are comfortable sending prompts, image URLs, and generated-asset metadata through OneKey Gateway and downstream 3D providers. Prefer the direct HTTPS API examples or a pinned, reviewed `onekey` version, keep `DEEPNLP_ONEKEY_ROUTER_ACCESS` out of logs and shell history where possible, and rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:241
Finding: Unpinned npm Package Execution Through npx
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:241-243
Additional Locations: SKILL.md:350-352, SKILL.md:442-444
Vulnerability Type: Insecure dependency resolution and execution
Risk Level: Medium

Vulnerable Code

bash
npx onekey agent craftsman-agent/craftsman-agent 3d_generator_task_create '{"prompt": "Generate A Figurine of Steve in Minecraft", "images": [], "provider_model_id": "tripo/tripo", "session_name": "3D Build Plan", "tag_list": "", "mode": "basic"}' npx onekey agent craftsman-agent/craftsman-agent 3d_generator_task_poll '{"task_id": "96b2116e-4b86-4d3c-af04-baf0da0c23ac", "kwargs": {"provider_model_id": "tripo/tripo", "mode": "basic"}}'

The same unpinned command pattern is repeated for image-to-model and multiview-to-model operations.

Technical Analysis

The documented workflow invokes the npm package onekey through npx without specifying a reviewed version. When the package is unavailable locally, npx can retrieve and execute the version currently resolved from the configured npm registry.

The project provides no lockfile, integrity hash, vendored implementation, package publisher verification, or version constraint for this executable dependency. Consequently, the code that runs may differ from the code originally assessed. A compromised package release, compromised maintainer account, registry substitution, or malicious package resolved through an untrusted registry configuration could result in arbitrary local code execution.

The commands are intended to run after DEEPNLP_ONEKEY_ROUTER_ACCESS has been exported. Code executed by the package therefore inherits access to that credential as well as the invoking user's local privileges.

Attack Path

A user obtains and exports the OneKey credential as instructed:

bash
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

The user runs one of the documented npx onekey ... commands.

If no trusted local copy is availab ...[truncated 1398 chars]
Remediation: View remediation
Remediation Suggestions

Pin the CLI to a specific, reviewed version:

bash
npx --yes onekey@<audited-version> agent craftsman-agent/craftsman-agent ...

Verify and document the exact npm package name, publisher, registry, version, and expected integrity hash.

Use a project-level dependency manifest and lockfile so dependency resolution is reproducible.

Configure npm to use a trusted HTTPS registry and avoid executing the command under registry overrides that have not been reviewed.

Prefer installation with lifecycle scripts disabled where compatible:

bash
npm install --ignore-scripts --save-exact onekey@<audited-version>

Review the pinned package and its transitive dependencies before use.

Run the CLI in a restricted environment with minimal filesystem access and only the required environment variable.

Prefer the documented direct HTTPS API workflow when the npm CLI and its dependency chain cannot be independently verified.

Rotate the OneKey credential immediately if an unexpected package version has already been executed.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: "3d-generator" description: "AI Generated 3D Models using SOTA APIs such as Tripo/Meshy/TripoSR/etc served on OneKey Agent Gateway by Craftsman Agent, useful for AI Game, Figurine, Stuffed Toy Generation" env: DEEPNLP_ONEKEY_ROUTER_ACCESS: required: true description: Onekey Gateway Registered API and Usage access key dependencies: node: [] python: [] --- # 3d-generator Skills from craftsman-agent The Workflow of typical 3D Model Generation is like below. This 3D generation APIs served on OneKey Gateway include the vendors from "TripoAI", "Meshy" APIs and used on Craftsman Agent 3D/IP/Toy Desi

Hidden Instructions

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
to use in CLIs, Skills, Rest APIs, and more agent preferred formats. The online 3D generator website is https://craftsman-agent.aiagenta2z.com/app/3d-generator. And you can also find gallery of 3D Generated Digital Assets in https://craftsman-agent.aiagenta2z.com/gallery/3d_generator. [//]: # (![3D Generated Images](https://us-static.aiagenta2z.com/local/files-wd/onekey_llm_router/7485ee2a-ae58-48e3-9dc8-eaf1d3d1c4a7.png)) <img src="https://us-static.aiagenta2z.com/local/files-wd/onekey_llm_router/7485ee2a-ae58-48e3-9dc8-eaf1d3d1c4a7.png" alt="Craftsman-agent Perler Beads for Minecraft Diamond Pickaxes" width="500" /> | Section | Description |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explains that requests go through OneKey Gateway and use vendors like TripoAI and Meshy, but it does not clearly warn users that prompts and uploaded image URLs are transmitted to external third parties. This can lead users to unknowingly send sensitive or proprietary content off-platform.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
1. Text to Model

1.1 Curl Request

Task Create API

bash

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
text
##### Outputs Parameters Definition | Parameters | Description | |------------|----------------------------------------------------------------------------------------------------------------------------------------------------| | provider_model_id | The 3D Generator provider id, such as "tripo/tripo", "meshy/meshy", | | task_id | The Task ID of created 3d generator Task |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
##### Outputs Parameters Definition | Parameters | Description | |------------|----------------------------------------------------------------------------------------------------------------------------------------------------| | provider_model_id | The 3D Generator provider id, such as "tripo/tripo", "meshy/meshy", | | task_id | The Task ID of created 3d generator Task | | session_id | The generated workspace session ID, you can view your session on workspace at https://craftsman-agent.aiagenta2z.com/workspace for logged in user. | | status | running,completed,etc |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
| Parameters | Description | |------------|----------------------------------------------------------------------------------------------------------------------------------------------------| | provider_model_id | The 3D Generator provider id, such as "tripo/tripo", "meshy/meshy", | | task_id | The Task ID of created 3d generator Task | | session_id | The generated workspace session ID, you can view your session on workspace at https://craftsman-agent.aiagenta2z.com/workspace for logged in user. | | status | running,completed,etc |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
| provider_model_id | The 3D Generator provider id, such as "tripo/tripo", "meshy/meshy", | | task_id | The Task ID of created 3d generator Task | | session_id | The generated workspace session ID, you can view your session on workspace at https://craftsman-agent.aiagenta2z.com/workspace for logged in user. | | status | running,completed,etc | #### Task Poll API

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
bash
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.
bash
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.
bash
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The sample output includes signed asset URLs and internal object-storage paths associated with generated content. Even if example-only, publishing real signed links or storage structure can expose private assets temporarily and leaks internal bucket/key naming conventions useful for reconnaissance.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The documentation instructs users to run npx onekey without pinning a specific package version. This allows whatever version is current in the registry at execution time to be fetched and executed, creating a supply-chain risk if a malicious or compromised release is published.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This CLI example uses npx onekey without a pinned version, which can cause users to execute unreviewed code from the package registry. In security-sensitive tooling, version drift and package compromise make this a real supply-chain exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The unpinned npx onekey command introduces a remote code execution path via package resolution at runtime. Anyone following the docs may run a newer or malicious package than the author intended.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx onekey without an exact version means the executed package is not stable or auditable over time. This increases exposure to registry compromise, typosquatting, or a malicious upstream update.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.
md
## 3.1 Curl Request #### Inputs Parameters Definition | Parameters | Description | |-------------------|-----------------------------------------------------------------------------------------------| | prompt | Text Prompt | | images | Array of image URLs |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.
md
## 3.1 Curl Request #### Inputs Parameters Definition | Parameters | Description | |-------------------|-----------------------------------------------------------------------------------------------| | prompt | Text Prompt | | images | Array of image URLs |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 372)May include surrounding context.
bash
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This example again promotes execution of an unpinned package from the registry. In agent tooling, that can directly affect local environment access, credentials, and downstream API calls if the package is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: An unpinned npx command is a genuine supply-chain weakness because package contents can change between runs. The skill context makes this more dangerous because the tool is used with API credentials and external service access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The examples show how to place the access key in requests but do not warn users to keep the credential secret or avoid copying it into shared logs, screenshots, or shell history. This increases the risk of accidental credential disclosure and unauthorized API usage.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

Hidden Instructions

Missing User Warnings

External Transmission

1. Text to Model

1.1 Curl Request

Task Create API

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

External Transmission

External Transmission

External Transmission

Ssd 3

Rp1

Rp1

Rp1

Rp1

Whitespace Padding

Whitespace Padding

External Transmission

Rp1

Rp1

Missing User Warnings