ClawHub
Back to skill

Security audit

figurine-generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward guide for using an external toy and 3D model generation API, with privacy considerations around uploaded prompts, images, and share links.

Install only if you are comfortable sending generation prompts, image URLs, and resulting assets to the OneKey/Craftsman gateway and downstream 3D providers. Keep the DEEPNLP_ONEKEY_ROUTER_ACCESS key private, and treat returned share_url links as sensitive because anyone with the link and key-like parameters may be able to view task results.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly routes prompts, images, and generated assets through external gateway and third-party 3D generation services, but it does not warn users that their inputs and outputs leave the local agent context. This creates a real privacy and data-handling risk because users may submit sensitive images, proprietary designs, or confidential prompts without informed consent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation tells users to share or rely on returned private share URLs without warning that possession of the link may grant access to generated content, progress, previews, and related workspace data. If such URLs are pasted into chats, logs, tickets, or public channels, unauthorized parties may access private assets and task status.

Static analysis

No suspicious patterns detected.