Craftsman Agent 3D Generation Skills

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:49 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it handles API credentials and dependency installation in ways users should review before installing.

Review this before installing if you will use real API credentials or sensitive prompts. Prefer a scoped throwaway API key, avoid prompts or reference URLs containing private assets, and be cautious about the unpinned global/package install steps. The package does not show malicious behavior, persistence, or local data theft in the inspected files, but its credential transport and dependency instructions are not tight enough for a routine benign pass.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_lego_build_plan.py:65

Finding

API Credential Exposed in URL Query String in LEGO Python Client

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_lego_build_plan.py, lines 65-66
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

python

query = parse.urlencode({"onekey": api_key})
url = f"{ENDPOINT}?{query}"

Technical Analysis

The script reads DEEPNLP_ONEKEY_ROUTER_ACCESS and embeds its value in the request URL as the onekey query parameter. Although the endpoint uses HTTPS, query strings are frequently recorded by destination access logs, reverse proxies, monitoring systems, tracing infrastructure, and diagnostic tools.

Credential transmission is necessary for the declared hosted API operation, but placing the credential in a URL is not necessary. Authentication should use a request header designed for sensitive credentials.

The script does not intentionally print the URL or credential. Exploitation therefore depends on the credential-bearing URL being retained or exposed by infrastructure handling the request.

Attack Path

1. A user configures a paid API credential in DEEPNLP_ONEKEY_ROUTER_ACCESS.
2. The script copies that credential into the request URL.
3. The destination server, a reverse proxy, or monitoring infrastructure records the complete URL.
4. An attacker or unauthorized operator with access to those records extracts the onekey value.
5. The attacker submits requests using the recovered credential.

Impact Assessment

Successful exploitation could allow unauthorized use of the affected OneKey Gateway account, including quota consumption, paid request generation, and activity attributed to the credential owner. The exposed privilege is limited to the authorization scope granted to the API key; this finding does not provide direct local system access.

Remediation

View remediation

Remediation Suggestions

• Transmit the credential in an authentication header, such as Authorization: Bearer ..., if supported by the service.
• If the service uses a custom scheme, use a dedicated header such as X-API-Key.
• Ensure error handling, tracing, and debugging logic redact authentication headers.
• Never print or persist a credential-bearing URL.
• Configure gateway and proxy logs to redact existing onekey query parameters.
• Rotate credentials that may already have been retained in logs.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_minecraft_build_plan.py:67

Finding

API Credential Exposed in URL Query String in Minecraft Python Client

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_minecraft_build_plan.py, lines 67-68
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

python

query = parse.urlencode({"onekey": api_key})
url = f"{ENDPOINT}?{query}"

Technical Analysis

The script places the value of DEEPNLP_ONEKEY_ROUTER_ACCESS in the request URL. HTTPS encrypts the request in transit, but it does not prevent the destination service, reverse proxies, observability systems, or diagnostic tooling from retaining the complete URL.

Sending an authentication credential is required for the declared service, but using a query string exceeds the minimum exposure necessary. A protected request header should be used instead.

Attack Path

1. A user supplies a valid API credential through the documented environment variable.
2. The script constructs a URL containing the credential.
3. Request-processing infrastructure records the URL.
4. A party with unauthorized access to those logs recovers the credential.
5. The party reuses the credential against the hosted API.

Impact Assessment

The recovered credential could permit requests within its assigned authorization and billing scope, resulting in unauthorized usage, quota exhaustion, or financial cost. No direct operating-system privilege escalation was identified.

Remediation

View remediation

Remediation Suggestions

• Replace query-string authentication with an authorization or dedicated API-key header.
• Redact credentials from application, gateway, proxy, and monitoring logs.
• Avoid including complete authenticated URLs in exceptions or diagnostics.
• Rotate potentially logged production credentials.
• Document the expected credential transport mechanism and validate that it is consistently used by every client.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_lego_build_plan.ts:53

Finding

API Credential Exposed in URL Query String in LEGO TypeScript Client

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_lego_build_plan.ts, lines 53-54
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

typescript

const url = new URL(ENDPOINT);
url.searchParams.set("onekey", apiKey);

Technical Analysis

The TypeScript client places the API key in the URL query string before calling fetch. Query parameters can be retained by servers, proxies, telemetry products, or debugging systems even when HTTPS protects the network connection.

The network request itself is consistent with the Skill's declared hosted build-plan functionality. The unnecessary risk arises specifically from the credential transport mechanism.

Attack Path

1. The user exports a valid OneKey Gateway credential.
2. The client appends it to the request URL.
3. Infrastructure handling the request logs or traces the full URL.
4. An attacker obtains access to the resulting record.
5. The attacker extracts and reuses the credential.

Impact Assessment

An exposed key could be used to consume the associated API capabilities, quota, or paid services. Access is bounded by the key's server-side permissions and does not independently grant local code execution or filesystem access.

Remediation

View remediation

Remediation Suggestions

• Pass the API key through an Authorization or dedicated API-key header.
• Ensure thrown errors and telemetry do not serialize sensitive request headers.
• Add gateway-side redaction for the legacy onekey query parameter.
• Rotate keys that could have appeared in historical logs.
• Centralize authenticated request construction to prevent inconsistent credential handling across clients.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_minecraft_build_plan.ts:53

Finding

API Credential Exposed in URL Query String in Minecraft TypeScript Client

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_minecraft_build_plan.ts, lines 53-54
Vulnerability Type: API credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

typescript

const url = new URL(ENDPOINT);
url.searchParams.set("onekey", apiKey);

Technical Analysis

The client embeds the value of DEEPNLP_ONEKEY_ROUTER_ACCESS in the URL. While TLS prevents ordinary network observers from reading the query, URLs remain susceptible to retention in server access logs, reverse-proxy logs, tracing platforms, and diagnostic records.

Authentication is legitimate for the declared API operation, but exposing the credential through a query parameter is not the least-risk mechanism.

Attack Path

1. The client retrieves a valid credential from the environment.
2. It appends that credential to the request URL.
3. A server, proxy, or observability component stores the complete URL.
4. An unauthorized party accesses the stored record.
5. The party replays the credential to invoke the API.

Impact Assessment

Exploitation can result in unauthorized API calls, quota depletion, billing impact, and actions attributed to the credential owner. The maximum scope is determined by the permissions assigned to the exposed credential.

Remediation

View remediation

Remediation Suggestions

• Use an authentication header instead of URL.searchParams.
• Prevent authenticated request URLs from being logged or included in exception output.
• Redact the onekey parameter throughout server and proxy infrastructure.
• Rotate credentials that may have been previously exposed.
• Apply the same secure request helper to both TypeScript clients.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned and Unnecessary Third-Party Package Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-16, 92-102, and 105-107
Vulnerability Type: Unpinned third-party dependencies and excessive installation scope
Risk Level: Medium

Vulnerable Code

yaml

dependencies:
  npm:
    - "@aiagenta2z/onekey-gateway"
  python:
    - "ai-agent-marketplace"
installation:
  npm: npm -g install @aiagenta2z/onekey-gateway
  python: pip install ai-agent-marketplace

markdown

### CLI Dependency
Install onekey-gateway from npm

npm install @aiagenta2z/onekey-gateway

text

### Script Dependency
Install the required Python package before running any scripts.

pip install ai-agent-marketplace

text

markdown

### Agent rule
Before executing command lines or running any script in the scripts/ directory, ensure the dependencies are installed.
Use the `onekey` CLI as the preferred method to run the skills.

Technical Analysis

The instructions install mutable npm and PyPI package versions without version pins, integrity hashes, or lockfiles. The npm installation declaration additionally uses global installation, increasing the affected scope.

The audited Python scripts use standard-library modules, and the TypeScript scripts use Node.js built-ins and the runtime fetch API. None of the four scripts imports either declared package. Requiring installation before running these scripts therefore exceeds the minimum dependencies necessary for their documented direct execution.

Package installation may execute lifecycle or setup code with the privileges of the user performing the installation. If a package account, release process, registry entry, or transitive dependency is compromised, the resolved package can execute attacker-controlled code before the build-plan script runs.

Attack Path

1. An agent follows the mandatory installation rule before executing a bundled script.
2. npm or pip resolves the ...[truncated 1079 chars]

Remediation

View remediation

Remediation Suggestions

• Remove both package-installation requirements from the direct script workflow unless they are technically required.
• Clearly separate any optional OneKey CLI workflow from the bundled Python and TypeScript clients.
• Pin every required dependency to a reviewed exact version.
• Use lockfiles and integrity verification for npm dependencies.
• Use hash-checked requirements, such as pip install --require-hashes, for Python dependencies.
• Avoid global npm installation; use a project-local dependency and invoke it through a pinned package script.
• Disable unnecessary package lifecycle scripts where operationally possible.
• Document why each dependency is needed and which files import or invoke it.
• Remove the reference to requirements.txt unless a reviewed requirements file is added to the project.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill declares environment variable and network-dependent behavior but does not define an explicit tool/permission scope. In an agent setting, this can cause the runtime or operator to underestimate what the skill is allowed to access, increasing the risk of unintended outbound requests or secret handling without clear consent boundaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation instructs users or agents to automatically fall back to a hardcoded API key when no user-provided credential is present. Hardcoded shared credentials are unsafe because they encourage unauthorized service use, make attribution impossible, and normalize secret-in-code practices that can be abused or unexpectedly revoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells users to use a fallback key with a remote hosted API but does not clearly warn that prompts and reference image URLs will be transmitted off-box. Because this skill is specifically designed to send user creative prompts and image references to an external service, the missing disclosure materially increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends the user-provided prompt and reference image URLs to a remote third-party endpoint, but it does not clearly disclose at the point of use what data will leave the local environment. Users may unintentionally transmit sensitive design ideas, proprietary text, internal URLs, or identifying image references to an external service, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script hardcodes a fallback demo API key and automatically uses it when no user-provided key is present. Embedding live credentials in distributed code is dangerous because anyone with the script can extract and reuse the key for unauthorized API access, abuse shared quota, or impersonate legitimate usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script transmits user prompts and reference image URLs to a remote third-party endpoint without an explicit privacy notice, consent flow, or safeguards around potentially sensitive content. Because build prompts or image URLs may contain private project data, personal information, or internal links, this can lead to unintended data disclosure to the external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script places the API key in the URL query string (?onekey=...) before sending the request. Even over HTTPS, query parameters are commonly exposed in client logs, proxy logs, browser/history equivalents, monitoring systems, and server access logs, which increases the chance of credential leakage beyond the intended recipient. In this skill context, the script is explicitly designed to call a remote service, so the risk is real rather than theoretical.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script transmits the user prompt and reference image URLs to an external endpoint without an explicit warning or consent mechanism. For a build-plan generator this remote transmission is functionally necessary, but it still creates a privacy and data-handling risk because users may submit sensitive prompts, proprietary designs, or internal image links without realizing they are being sent off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code falls back to an embedded demo API key and then performs a remote request, which means anyone running the script without their own credential will still send data to the external service. Hardcoded shared credentials reduce accountability, can be abused or revoked unexpectedly, and make the remote transmission easier to trigger without the operator fully understanding that an authenticated third-party call is occurring.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This script transmits the user-provided prompt and any reference image URLs to a remote third-party endpoint, but the CLI does not provide a clear, explicit warning at the point of use that input data will leave the local environment. In a build-plan generator, prompts and image URLs may contain proprietary designs, private assets, or internal project details, so silent exfiltration to a hosted service creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 70% confidence

Finding

The code pulls credentials from process environment state to authenticate outbound requests. While network access is expected for this skill, reading ambient credentials is a distinct capability not mentioned in the manifest and is only weakly justified by the stated purpose.

Content

No source excerpt is available for this finding.