ClawHub
Back to skill

Security audit

Generate Perler Beads Pindou

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a remote API wrapper for generating bead patterns, but its execution path is under-scoped and relies on credential-bearing outbound requests and an unpinned external CLI.

Review before installing. Use this only if you are comfortable sending prompts, image URLs, and an optional OneKey access key to the documented external services. Prefer direct, pinned, reviewed API calls over the unpinned npx command, and provide only the specific access key needed for this service.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:138
Finding

Unpinned npx Package Execution Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 138
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code snippet:

shell
npx onekey agent craftsman-agent/craftsman-agent generate_perler_bead_pindou '{"prompt":"","images":["https://minecraft.wiki/images/Diamond_Pickaxe_JE3_BE3.png?7409d="],"width":16,"height":16,"brand":"default"}'

Technical Analysis

The documented command instructs users to execute the onekey package through npx without specifying an exact version. If the package is not already installed locally, npx may retrieve and execute it from the configured package registry.

No pinned version, lockfile, integrity hash, verified installation procedure, or reviewed local copy is provided for this execution path. Consequently, the code executed by this command can change after the Skill has been audited. This creates exposure to package-account compromise, malicious future releases, dependency substitution, and registry configuration attacks.

The project metadata states that the Skill has no Node dependencies, so this remotely resolved CLI is also outside the declared dependency set.

Attack Path

  1. An attacker compromises the publisher account or distribution channel for the onekey package, publishes a malicious future release, or causes the victim to resolve the package through a malicious registry.
  2. A user follows the command documented in SKILL.md.
  3. Because no version is pinned, npx resolves and downloads the currently available package.
  4. Package lifecycle logic or the CLI entrypoint executes with the privileges of the invoking user.
  5. The malicious package can access resources available to that user, including project files and environment variables.

Impact Assessment

Successful exploitation permits arbitrary code execution with the invoking user's privileges. The affected scope may include readable or writable loca ...[truncated 316 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to a specifically reviewed version, for example npx --yes onekey@<audited-version> ....
  • Declare the package in a package manifest and commit a lockfile with integrity metadata.
  • Use npm ci against the committed lockfile rather than resolving an unconstrained package at execution time.
  • Document the expected registry, official package publisher, and package provenance.
  • Enable package-signature or provenance verification where supported.
  • Prefer a vendored, checksummed, or preinstalled audited CLI in security-sensitive environments.
  • Run the CLI with minimal privileges and expose only the environment variables and files required for the operation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description suggests direct generation of pixelized output and workspace artifacts, but no visible local generation logic is present in the file; instead it documents generic HTTP dispatch with env-based auth. This can mislead operators into granting trust and permissions inappropriate for what is effectively a remote request launcher.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description suggests direct generation of pixelized output and workspace artifacts, but no visible local generation logic is present in the file; instead it documents generic HTTP dispatch with env-based auth. This can mislead operators into granting trust and permissions inappropriate for what is effectively a remote request launcher.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description suggests direct generation of pixelized output and workspace artifacts, but no visible local generation logic is present in the file; instead it documents generic HTTP dispatch with env-based auth. This can mislead operators into granting trust and permissions inappropriate for what is effectively a remote request launcher.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill advertises network use, environment-based authentication, and script execution patterns but does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, missing permission declarations increase the risk of over-broad runtime capabilities and make it harder for users or orchestrators to understand that external requests and secret-bearing operations may occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly asks for user prompts and image URLs, then sends them to external HTTP endpoints without any privacy, retention, or third-party processing warning. This is risky because image URLs and prompts may contain sensitive or proprietary information, and users are not informed that their content leaves the local agent environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The curl example demonstrates transmission of user-controlled data plus an authentication header to an external routing service. While expected for an API client, it still creates a real exfiltration and trust-boundary risk if users assume the skill operates locally or do not realize that prompts, URLs, and metadata are sent off-platform.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

the image url is : https://minecraft.wiki/images/Diamond_Pickaxe_JE3_BE3.png?7409d= And the access key can be found in DeepNLP Router Access Keys Generation

Curl

bash
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_perler_bead_pindou.py (reported line 10)May include surrounding context.

python
def main():
    script = os.path.join(os.path.dirname(__file__), "run_api.py")
    args = [sys.executable, script, "--api", "generate_perler_bead_pindou"] + sys.argv[1:]
    res = subprocess.run(args)
    raise SystemExit(res.returncode)

if __name__ == "__main__":

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code performs an HTTP request using user-supplied data and may attach a credential sourced from an environment variable, but the script provides no confirmation, no informational log about the destination, and no inline comment or docstring warning about the transmission. For a code file, this matches missing user disclosure for network calls that may transmit user or system data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This file implements a generic API runner that loads method, endpoint, headers, and auth behavior from external metadata and then performs arbitrary HTTP requests. That capability materially exceeds the stated bead-pattern generation purpose and could be repurposed to contact unintended external systems, exfiltrate data, or act as a general network proxy within the agent environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script can inject authentication material from environment variables into outbound requests based on metadata, giving the skill a credential-bearing network capability unrelated to simple bead-pattern generation. In a skill context, this expands the blast radius from harmless content generation to potential access of third-party APIs or internal services if the metadata is modified or overly broad.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code sends user-supplied payload data and optional authentication headers to external endpoints without any explicit disclosure, confirmation, or data-minimization controls. In a hobby-pattern skill, users would not reasonably expect arbitrary outbound transmission of their inputs and possibly secret-backed requests, making this behavior more suspicious and privacy-impacting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script reads authentication material from environment variables and injects it into request headers. There is no nearby comment, prompt, or other user-facing notice explaining that credential-bearing environment variables may be accessed and transmitted during execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code performs an outbound HTTP request using a user-supplied payload and headers derived from API metadata, including possible credentials loaded from environment variables. While errors are logged, there is no user-facing disclosure, confirmation, or explanatory comment/docstring warning that request data and auth headers may be sent to an external endpoint.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/generate_perler_bead_pindou.js:8

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/generate_perler_bead_pindou.ts:7

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/run_api.js:36

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/run_api.ts:44