Security audit

3d-printing-generator

Security checks for vulnerabilities and agentic risk

Overview

This cloud 3D toy generator is mostly purpose-aligned, but it asks users to use an API key with external services and includes unpinned npm CLI commands that deserve review before installation.

Review before installing. Use the REST API examples over the unpinned `npx` CLI, avoid sending confidential prompts or private image URLs, treat returned share URLs like secrets, and use a short-lived least-privilege OneKey access key if possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:214
Finding: Unpinned npm Package Execution Through npx
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:214, SKILL.md:322, and SKILL.md:486
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

shell
npx onekey agent craftsman-agent/craftsman-agent toy_generator_design_draft '{"prompt":"Stuffed Steve in Minecraft","images":["https://static.aiagenta2z.com/container/craftsman-agent/default/static/derekzz/a49f905b-4e0d-40c6-af7a-c37be3d1741e/3ccb042bbd9b41c3a9f5d31c564ef4c0.png"],"asset_size":"small","template_id":"stuffed-toy","provider_model_id":"default","session_name":"3D Build Plan","tag_list":"","mode":"basic"}'

shell
npx onekey agent craftsman-agent/craftsman-agent toy_generator_task_create '{"prompt":"","images":["https://static.aiagenta2z.com/container/craftsman-agent/default/static/derekzz/a49f905b-4e0d-40c6-af7a-c37be3d1741e/3ccb042bbd9b41c3a9f5d31c564ef4c0.png"],"multi_view":{"front":"https://craftsman-agent.aiagenta2z.com/static/derekzz/75302fb3-b0f4-4bfe-a406-1c97eda64dbf/build_front.png","right":"https://craftsman-agent.aiagenta2z.com/static/derekzz/75302fb3-b0f4-4bfe-a406-1c97eda64dbf/build_right.png","back":"https://craftsman-agent.aiagenta2z.com/static/derekzz/75302fb3-b0f4-4bfe-a406-1c97eda64dbf/build_back.png"},"asset_size":"small","template_id":"stuffed-toy","provider_model_id":"tripo/tripo","model":"P1-20260311","session_name":"3D Build Plan","tag_list":"","mode":"basic"}'

shell
npx onekey agent craftsman-agent/craftsman-agent toy_generator_task_poll '{"task_id":"96b2116e-4b86-4d3c-af04-baf0da0c23ac","kwargs":{"provider_model_id":"tripo/tripo","mode":"basic"}}'

Technical Analysis

The documented CLI commands invoke onekey through npx without specifying an exact package version or verifying package integrity. If the package is absent locally, npx may resolve, download, and execute the version currently published in the configured npm registry.

This creates a supply-chain trust boundary that is not ca ...[truncated 1789 chars]
Remediation: View remediation
Remediation Suggestions

Prefer the documented HTTPS REST API examples, which avoid executing an npm package locally.

If the CLI is required, identify and document its authoritative publisher and trusted registry.

Pin the package to a reviewed exact version rather than allowing dynamic resolution:

shell
npx --yes onekey@<reviewed-exact-version> ...

Maintain a lockfile and verify npm integrity metadata. In controlled environments, install dependencies with npm ci from a committed, reviewed lockfile.

Do not execute the package with elevated privileges.

Run the CLI in a restricted container or sandbox with minimal filesystem and network access.

Use a short-lived, least-privilege gateway token and expose it only to the process that requires it.

Review package updates before changing the pinned version, including lifecycle scripts and transitive dependencies.

Revoke and rotate the gateway key immediately if execution of an untrusted package is suspected.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (43)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill documentation does not clearly warn that user prompts, image URLs, and related generation inputs are transmitted to external services via the OneKey Agent Gateway and downstream providers such as Tripo/Meshy. This can lead to unintended disclosure of sensitive data, proprietary designs, or personal content because users are not given informed consent or data-handling expectations.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
text
| API | Description | | -------------------------- | ------------------------------------------------------------------------------------------- | | toy_generator_design_draft | Generate a toy design draft and multi-view reference sheets from text prompts and/or images | | toy_generator_task_create | Create a new Toy 3D Generation Task from images, prompts, and/or multi-view references |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
#### Requests Input Parameter | Parameter | Description | | ----------------- | ----------------------------------------------------------------------------------------------- | | prompt | Text prompt describing the desired toy | | images | Array of source image URLs used as visual references |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.
md
#### Requests Input Parameter | Parameter | Description | | ----------------- | ----------------------------------------------------------------------------------------------- | | prompt | Text prompt describing the desired toy | | images | Array of source image URLs used as visual references |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
**mode**: The mode as complexity of design for each generation task | mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.
md
**mode**: The mode as complexity of design for each generation task | mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
md
| mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
| mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
| mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: This example sends user-supplied prompts, image URLs, and session metadata to an external endpoint along with an access key. External transmission is expected for this skill's functionality, but it is still a real security/privacy concern because sensitive user content and credentials are involved and the doc does not pair the example with strong cautions about data sensitivity and key handling.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
commandline
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The examples expose share_url values and instruct the operator to notify users of these links without warning that the URLs may act as bearer-style access tokens to private generated content. If such links are logged, forwarded, or displayed in insecure contexts, unauthorized parties may access generation status, images, or models without further authentication.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill instructs users to run npx onekey without pinning a specific package version. Because npx resolves the latest published package by default, a compromised or malicious upstream release could execute attacker-controlled code on the user's machine at install/run time. In a skill document, this is a real supply-chain risk rather than a purely stylistic issue.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.
md
#### Request Input Parameters | Parameter | Description | | ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
md
| Parameter | Description | | ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.
md
| ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.
md
| prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.
md
| images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 388)May include surrounding context.
md
| images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 390)May include surrounding context.
md
| images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.
md
| template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session | | tag_list | Optional tags | | mode | Generation mode such as `basic`, `standard`, `advanced`, or `demo` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 378)May include surrounding context.
md
| template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session | | tag_list | Optional tags | | mode | Generation mode such as `basic`, `standard`, `advanced`, or `demo` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.
md
| provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session | | tag_list | Optional tags | | mode | Generation mode such as `basic`, `standard`, `advanced`, or `demo` |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The task-creation request transmits reference images, multi-view URLs, prompts, and other metadata to an external gateway and downstream provider. In context this is part of intended functionality, but it remains dangerous if users assume local-only processing or if confidential assets are uploaded without clear notice.
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
text
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This CLI example again uses npx onekey without version pinning, exposing users to unintended package upgrades or a poisoned upstream package. Since the command is presented as a copy-paste workflow step, it increases the chance of real-world exploitation through the JavaScript package supply chain.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 82% confidence
Finding: The polling example transmits task identifiers and provider metadata to the external gateway. This is less sensitive than uploading prompts or images, but it still reveals workflow metadata and depends on a remote service, so users should be informed that monitoring activity leaves the local environment.
Content: Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.
commandline
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Missing User Warnings

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

External Transmission

Missing User Warnings

Rp1

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

External Transmission

Rp1

External Transmission