Craftsman Agent 3D Generation Skills

• Outcome: Review
• Latest audit: May 28, 2026 · 1:05 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its build-plan purpose, but it automatically uses a bundled shared demo key and sends prompts or image URLs to an external service, so users should review it before use.

Install only if you trust the DeepNLP/OneKey Gateway service with your prompts, reference image URLs, and API key. Prefer setting your own scoped DEEPNLP_ONEKEY_ROUTER_ACCESS value, avoid private designs or internal image links, and be aware that if no key is set the scripts will still contact the service using the bundled demo key.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The documentation tells operators to silently fall back to a hardcoded API key when the user's credential is absent. Hardcoded shared credentials are unsafe because they bypass normal authentication expectations, encourage unauthorized external service use, and can expose users to rate-limit abuse, service misuse, or trust confusion about whose account is being used.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script embeds a hard-coded fallback API key and automatically uses it when the expected environment variable is missing. Shipping built-in credentials is insecure because the key can be extracted, reused by unauthorized parties, and normalizes silent credential substitution without explicit user consent or auditability.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script embeds a usable fallback API credential and automatically uses it when the environment variable is absent. Hardcoded shared keys are insecure because anyone with access to the code can reuse the credential, causing unauthorized consumption, loss of auditability, and possible abuse under the publisher's account.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: The user-facing message implies the service requires the user's own paid credential, but the script then silently authenticates with a bundled key after a delay. This misleading behavior reduces informed consent and can hide credential use and third-party data transfer from the operator.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The fallback-key guidance lacks a strong warning that the skill will contact an external service using non-user credentials. In an agent context, this is more dangerous because automated setup may proceed without informed consent, causing unintended data transmission in prompts or images to a third-party endpoint.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script transmits the user's prompt and reference image URLs to a third-party endpoint, but the user experience does not clearly disclose that potentially sensitive input will leave the local environment. In this skill context, external transmission is expected for a hosted generation API, but the lack of explicit warning or consent can still expose proprietary designs, private URLs, or sensitive project details.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: A hardcoded demo API key is a real secret-management flaw even if labeled as a demo credential. Attackers or unintended users can extract and reuse it, leading to unauthorized API access, quota exhaustion, billing exposure, and difficulty attributing actions to specific users.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends the user's prompt and reference image URLs to a remote service without a prominent privacy notice or consent step. Because prompts and image references may contain proprietary, personal, or sensitive data, undisclosed transmission increases the risk of data leakage and unexpected third-party processing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script sends the user-provided prompt and reference image URLs to a third-party remote endpoint, but the interface does not clearly disclose this data transfer at the point of use. In a build-plan skill, prompts or image URLs may contain proprietary designs, private project details, or internal links, so undisclosed off-host transmission creates a meaningful confidentiality and privacy risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This script sends the user-provided prompt and any reference image URLs to a remote third-party endpoint, but the only warning shown to the user concerns API key setup and pricing, not data disclosure. Users may reasonably assume local processing or may unknowingly transmit sensitive prompts, private build ideas, or internal image links to an external service, creating a privacy and confidentiality risk.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/generate_lego_build_plan.ts:44

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/generate_minecraft_build_plan.ts:44