Security audit

3d-printing-generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed guide for using remote 3D toy-generation APIs, with privacy-sensitive remote prompts, image URLs, and share links that users should handle carefully.

Install only if you are comfortable using the OneKey/Craftsman remote generation service. Do not submit confidential prompts or private images unless you intend them to be processed externally, and share returned workspace/model links only with intended recipients.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill routes user prompts and image URLs to third-party remote generation APIs, but the documentation does not clearly warn users that their content will leave the local environment and be processed by external services. This can expose sensitive prompts, proprietary images, or personal data to external operators, which is a genuine privacy and data-handling risk even if it is part of the intended functionality.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation describes share_url values as private links that can be used to view task progress and results, yet instructs agents to pass them along without warning that possession of the URL may grant access to generated content. If these links are exposed in logs, chats, or to unintended recipients, unauthorized parties may access private workspaces, previews, or model outputs.

Static analysis

No suspicious patterns detected.