Security audit

Craftsman Agent Build Plans

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its build-plan purpose, but it automatically uses shared credentials and handles user API keys in a risky way.

Review before installing. Use only non-sensitive prompts and reference URLs, prefer setting your own API key intentionally, avoid relying on the built-in demo key, and consider running in an isolated environment. Be cautious with the required package installs because they are unpinned and broader than the included scripts appear to need.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_lego_build_plan.py:67
Finding: API Credential Transmitted in URL Query String
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Unpinned and Unnecessary Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
pip install ai-agent-marketplace== ``` 4. Avoid global npm installation. Use a project-local dependency with a committed lockfile. 5. Commit dependency manifests and lockfiles containing integrity data, and deploy with reproducible commands such as `npm ci`. 6. Use hash verification for Python dependencies, such as a locked requirements file with `--hash` entries and `pip install --require-hashes`. 7. Review package publisher identity, provenance, lifecycle scripts, transitive dependencies, and release history before approving a version. 8. Run package installation without administrative privileges and in an isolated environment where practical. 9. Remove or correct the reference to `requirements.txt`, since the audited directory structure does not contain that file. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation explicitly tells agents to use a built-in demo API key when the user has not provided credentials. Hardcoded or shared fallback credentials bypass user consent and normal authentication expectations, and they may lead to unauthorized third-party service usage, key abuse, logging under a shared account, or accidental policy violations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Instructing agents to use a shared demo key without explicit user opt-in encourages silent use of third-party credentials and weakens accountability. In this skill's context, which performs hosted API calls for build-plan generation, that behavior is especially risky because it normalizes unauthorized network access and can mask who authorized the external request.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares environment-variable and network-dependent behavior but does not define any explicit tool scope or allowed-tools boundary. That omission can cause an agent runtime to grant broader-than-necessary execution/network capability, increasing the chance of unintended outbound requests or secret exposure during skill use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script contains a hard-coded fallback API key and automatically uses it when the expected environment variable is absent. This exposes embedded third-party credentials/capacity to any user of the script, enabling unauthorized consumption of the remote service, potential quota exhaustion, and loss of control over who can invoke the external agent under that key.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script sends the user-provided prompt and reference image URLs to a remote third-party endpoint, but the only console messaging concerns API key setup and cost, not data disclosure. Users may reasonably assume this is a local build-plan generator and unintentionally transmit sensitive prompts, proprietary designs, or internal image URLs to an external service without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script transmits user-supplied prompts and reference image URLs to a third-party remote endpoint, but it does not present a clear just-in-time disclosure or confirmation at the point where potentially sensitive content is sent. In this skill context, users may paste proprietary designs, internal project ideas, or private image URLs, so silent transmission to an external service creates a real privacy and data-handling risk even if the behavior is functionally intended.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script embeds a hardcoded demo API key and automatically falls back to it when no user-provided credential is configured. Hardcoded shared credentials are unsafe because they can be extracted, reused by anyone with access to the code, and may unintentionally authorize remote requests under a common account, creating abuse, billing, attribution, or service-access risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script transmits user-supplied prompts and reference image URLs to a third-party remote endpoint without an explicit user-facing notice or confirmation at the point of transmission. Because prompts and image references may contain proprietary, private, or internal project information, this can cause unintended data disclosure to an external service.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/generate_lego_build_plan.ts:44

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/generate_minecraft_build_plan.ts:44