Security audit

game-asset-generator

Security checks for vulnerabilities and agentic risk

Overview

This Markdown-only skill is coherent for external toy and 3D asset generation, but it needs review because its CLI examples run an unpinned npm package while using an API key.

Before installing or using this skill, prefer the direct REST examples or pin and verify the `onekey` CLI package version. Do not submit secrets, confidential prompts, private image URLs, or regulated data unless you trust the gateway and downstream providers. Use a scoped, revocable API key and run any CLI client with least privilege.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:185
Finding: Unpinned npm Package Execution Through npx
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:185, SKILL.md:276, and SKILL.md:433
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:185:

shell
npx onekey agent craftsman-agent/craftsman-agent toy_generator_design_draft '{"prompt":"Stuffed Steve in Minecraft","images":["https://static.aiagenta2z.com/container/craftsman-agent/default/static/derekzz/a49f905b-4e0d-40c6-af7a-c37be3d1741e/3ccb042bbd9b41c3a9f5d31c564ef4c0.png"],"asset_size":"small","template_id":"stuffed-toy","provider_model_id":"default","session_name":"3D Build Plan","tag_list":"","mode":"demo"}'

SKILL.md:276:

shell
npx onekey agent craftsman-agent/craftsman-agent toy_generator_task_create '{"prompt":"","images":["https://static.aiagenta2z.com/container/craftsman-agent/default/static/derekzz/a49f905b-4e0d-40c6-af7a-c37be3d1741e/3ccb042bbd9b41c3a9f5d31c564ef4c0.png"],"multi_view":{"front":"https://craftsman-agent.aiagenta2z.com/static/derekzz/75302fb3-b0f4-4bfe-a406-1c97eda64dbf/build_front.png","right":"https://craftsman-agent.aiagenta2z.com/static/derekzz/75302fb3-b0f4-4bfe-a406-1c97eda64dbf/build_right.png","back":"https://craftsman-agent.aiagenta2z.com/static/derekzz/75302fb3-b0f4-4bfe-a406-1c97eda64dbf/build_back.png"},"asset_size":"small","template_id":"stuffed-toy","provider_model_id":"tripo/tripo","model":"P1-20260311","session_name":"3D Build Plan","tag_list":"","mode":"basic"}'

SKILL.md:433:

shell
npx onekey agent craftsman-agent/craftsman-agent toy_generator_task_poll '{"task_id":"96b2116e-4b86-4d3c-af04-baf0da0c23ac","kwargs":{"provider_model_id":"tripo/tripo","mode":"basic"}}'

Technical Analysis

The documented commands invoke the onekey npm package through npx without specifying an exact package version or verifying its integrity. If the package is not already available locally, npx may retrieve the current release from the configured npm registry and execu ...[truncated 2083 chars]
Remediation: View remediation
Remediation Suggestions

Replace unversioned invocations with an exact, reviewed version, for example:

shell
npx --yes onekey@X.Y.Z agent craftsman-agent/craftsman-agent ...

Substitute X.Y.Z with a verified release rather than a floating tag.

Document the authoritative npm package URL, expected publisher, and verified package provenance so users can detect dependency-confusion or package-identity problems.

Prefer installation through a committed lockfile using deterministic installation, such as npm ci, rather than downloading a mutable package at invocation time.

Verify package integrity through lockfile integrity metadata, signed provenance, trusted-publisher attestations, or independently published checksums.

Disable dependency lifecycle scripts during installation where compatible with the package:

shell
npm ci --ignore-scripts

Prefer the documented direct HTTPS REST API examples when local package execution and provenance verification are unnecessary.

Run the client with least privilege and expose only the required credential for the shortest possible duration. Use a narrowly scoped, revocable access key and rotate it if package compromise is suspected.

Execute the client in a restricted environment or container with limited filesystem and network access when handling sensitive credentials.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (15)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill sends prompts, source image URLs, task metadata, and results to an external gateway and downstream model providers, but the documentation does not prominently warn users about this data flow. This can lead to inadvertent disclosure of sensitive prompts, proprietary artwork, or internal asset references to third parties.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
text
| API | Description | | -------------------------- | ------------------------------------------------------------------------------------------- | | toy_generator_design_draft | Generate a toy design draft and multi-view reference sheets from text prompts and/or images | | toy_generator_task_create | Create a new Toy 3D Generation Task from images, prompts, and/or multi-view references |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
#### Requests Input Parameter | Parameter | Description | | ----------------- | ----------------------------------------------------------------------------------------------- | | prompt | Text prompt describing the desired toy | | images | Array of source image URLs used as visual references |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This example explicitly transmits user-supplied data and an access key to https://agent.deepnlp.org/agent_router, an external service. External transmission is expected for this skill's function, but it still represents a real security/privacy concern because prompts and image references may contain sensitive or proprietary material.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
commandline
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The documentation instructs users to run npx onekey without pinning a specific package version, which can cause execution of whatever version is currently published at install time. If the upstream package or one of its transient dependencies is compromised, users may execute attacker-controlled code on their systems.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
md
#### Request Input Parameters | Parameter | Description | | ----------------- | --------------------------------------------------------------------------------------------------------------------------------- | | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.
md
| Parameter | Description | | ----------------- | --------------------------------------------------------------------------------------------------------------------------------- | | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.
md
| Parameter | Description | | ----------------- | --------------------------------------------------------------------------------------------------------------------------------- | | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.
md
| images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.
md
| template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session | | tag_list | Optional tags | | mode | Generation mode such as `basic`, `standard`, `advanced`, or `demo` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.
md
| provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session | | tag_list | Optional tags | | mode | Generation mode such as `basic`, `standard`, `advanced`, or `demo` |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The task creation request sends source images, multi-view image URLs, prompts, and metadata to an external gateway for processing by third-party 3D providers. In context this is core functionality, but it still creates data exposure and trust-boundary risks if users assume processing is local or first-party only.
Content: Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.
text
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This example again uses unpinned npx onekey, exposing users to supply-chain risk because npx may fetch and execute the latest published package version. In a skill context, that means documentation itself can induce unsafe code execution practices.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: Polling the external gateway transmits task identifiers and provider metadata to a third-party endpoint. While lower sensitivity than the create/design steps, it still reveals workflow metadata and continues the dependency on an external service boundary.
Content: Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.
commandline
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The polling CLI example repeats the unsafe pattern of invoking npx onekey without a version pin. That creates avoidable supply-chain exposure whenever a user follows the documentation, especially since the command is intended to be copied verbatim.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code Snippets

Technical Analysis

Remediation Suggestions

SkillSpector

Missing User Warnings

Whitespace Padding

Whitespace Padding

External Transmission

Rp1

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

External Transmission

Rp1

External Transmission

Rp1