T08 · Insecure Dependencies
Warning
- Location
SKILL.md:214- Finding
Unpinned npm Package Execution Through npx
- Content
View full analysis
- Remediation
View remediation
Security audit
figurine-generator
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent 3D toy generation integration, but it includes unpinned npx commands that could run changing third-party code while an API key is present.
Install only if you are comfortable sending prompts, image URLs, task identifiers, and generated-asset links to the OneKey/Craftsman external services. Prefer the documented REST curl flow over the unpinned npx examples, treat DEEPNLP_ONEKEY_ROUTER_ACCESS and share_url links as sensitive, and avoid submitting confidential images, internal URLs, regulated data, or secrets unless your organization has approved that data flow.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (22)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 80% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key
text [//]: # () <img src="https://us-static.aiagenta2z.com/local/files-wd/onekey_llm_router/7485ee2a-ae58-48e3-9dc8-eaf1d3d1c4a7.png" alt="Craftsman-agent Perler Beads for Minecraft Diamond Pickaxes" width="500" /> | Section | Description |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill sends user prompts and image URLs to external generation services through the OneKey gateway and upstream providers, but the description does not clearly warn users that their content leaves the local environment. This creates a privacy and data-governance risk, especially if users provide sensitive prompts, proprietary images, or internal URLs.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
text | API | Description | | -------------------------- | ------------------------------------------------------------------------------------------- | | toy_generator_design_draft | Generate a toy design draft and multi-view reference sheets from text prompts and/or images | | toy_generator_task_create | Create a new Toy 3D Generation Task from images, prompts, and/or multi-view references |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md #### Requests Input Parameter | Parameter | Description | | ----------------- | ----------------------------------------------------------------------------------------------- | | prompt | Text prompt describing the desired toy | | images | Array of source image URLs used as visual references |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md **mode**: The mode as complexity of design for each generation task | mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This example shows prompts, images, and an API key being sent to an external endpoint. In the context of a generation skill, external transmission is expected, but it remains security-relevant because user content and credentials are sent off-platform and the documentation does not sufficiently foreground privacy implications.
- Content
commandline export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md #### Request Input Parameters | Parameter | Description | | ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | Parameter | Description | | ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`, `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session | | tag_list | Optional tags | | mode | Generation mode such as `basic`, `standard`, `advanced`, or `demo` |
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session | | tag_list | Optional tags | | mode | Generation mode such as `basic`, `standard`, `advanced`, or `demo` |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This request example creates a 3D generation task by transmitting user-supplied images and multi-view references to an external service. That behavior is core to the skill, but without strong disclosure and handling guidance it can lead to unintended disclosure of private content and metadata.
- Content
text export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation describes share_url values as private links with access keys but repeatedly instructs agents to notify users with those links, without warning that possession of the URL may grant access to generation outputs. Such links can be leaked through logs, chats, screenshots, or telemetry and expose private generated assets and session context.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
Polling task status against an external API continues the transmission of task identifiers and related metadata to a third-party service. While normal for this workflow, the skill should explicitly explain the data flow and sensitivity of task/session identifiers and returned URLs.
- Content
commandline export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{