Security audit
Security checks for vulnerabilities and agentic risk
The skill is a visible remote clothing/hat design API guide with no local persistence or hidden execution, though its scope is broader and less privacy-scoped than the name suggests.
Install only if you intend to use the Craftsman/DeepNLP remote clothing design service. Do not submit private reference-image URLs, unreleased designs, regulated personal data, or confidential brand assets unless you trust that service and its data handling; prefer a limited-use API key and pin the CLI package version if using the npx example.
The skill is branded as a hat/cap designer, but the body documents a much broader clothing-design capability set. This mismatch can cause agents or users to invoke broader remote functionality than expected, weakening scope boundaries and increasing the chance of unintended data disclosure or misuse of external APIs.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
[Manufacturing on Demand Send Designs to Factory]
| API | Description |
|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
| clothing_generator_design_draft | Generate Design Draft of your preferred Clothing type, e.g. shirts, texture, dimension, customized text and logo for printing. |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
#### Requests Input Parameter
| Parameter | Description |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `prompt` | Text description of the desired clothing style, material, fit, dimensions, decoration, printing, personalization, or manufacturing intent |
| `images` | Array of source image URLs used as visual references |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Parameter | Description |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `prompt` | Text description of the desired clothing style, material, fit, dimensions, decoration, printing, personalization, or manufacturing intent |
| `images` | Array of source image URLs used as visual references |
| `template_id` | Clothing template ID such as `t-shirt`, `shirt`, `polo-shirt`, `hoodie`, `jacket`, `coat`, `dress`, `skirt`, `pants`, `jeans`, `shorts`, `hat`, `scarf`, `gloves`, or `socks` |
| `options` | Structured customization parameters defined by the selected clothing template |
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `prompt` | Text description of the desired clothing style, material, fit, dimensions, decoration, printing, personalization, or manufacturing intent |
| `images` | Array of source image URLs used as visual references |
| `template_id` | Clothing template ID such as `t-shirt`, `shirt`, `polo-shirt`, `hoodie`, `jacket`, `coat`, `dress`, `skirt`, `pants`, `jeans`, `shorts`, `hat`, `scarf`, `gloves`, or `socks` |
| `options` | Structured customization parameters defined by the selected clothing template |
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
| `session_name` | Name of the generated workspace session |
| `tag_list` | Optional tags associated with the generation |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `images` | Array of source image URLs used as visual references |
| `template_id` | Clothing template ID such as `t-shirt`, `shirt`, `polo-shirt`, `hoodie`, `jacket`, `coat`, `dress`, `skirt`, `pants`, `jeans`, `shorts`, `hat`, `scarf`, `gloves`, or `socks` |
| `options` | Structured customization parameters defined by the selected clothing template |
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
| `session_name` | Name of the generated workspace session |
| `tag_list` | Optional tags associated with the generation |
| `mode` | Generation mode: `basic`, `standard`, `advanced`, or `demo` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `template_id` | Clothing template ID such as `t-shirt`, `shirt`, `polo-shirt`, `hoodie`, `jacket`, `coat`, `dress`, `skirt`, `pants`, `jeans`, `shorts`, `hat`, `scarf`, `gloves`, or `socks` |
| `options` | Structured customization parameters defined by the selected clothing template |
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
| `session_name` | Name of the generated workspace session |
| `tag_list` | Optional tags associated with the generation |
| `mode` | Generation mode: `basic`, `standard`, `advanced`, or `demo` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `options` | Structured customization parameters defined by the selected clothing template |
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
| `session_name` | Name of the generated workspace session |
| `tag_list` | Optional tags associated with the generation |
| `mode` | Generation mode: `basic`, `standard`, `advanced`, or `demo` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
| `session_name` | Name of the generated workspace session |
| `tag_list` | Optional tags associated with the generation |
| `mode` | Generation mode: `basic`, `standard`, `advanced`, or `demo` |
#### Input Parameter Options
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
**mode**: The mode as complexity of design for each generation task
| ID | Description |
| ---------- | ------------------------------------------------------------------------------------------------------------ |
| `basic` | Basic complexity for design |
| `standard` | Standard complexity for design |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| ID | Description |
| ---------- | ------------------------------------------------------------------------------------------------------------ |
| `basic` | Basic complexity for design |
| `standard` | Standard complexity for design |
| `advanced` | Advanced complexity for design |
| `demo` | Demo mode for predefined/debug API results; use `basic`, `standard`, or `advanced` for production generation |
The skill instructs users to send prompts, image URLs, session names, tags, and potentially design-related data to an external gateway without an explicit privacy/transmission warning. In an agent setting, users may reasonably assume local processing, so the lack of disclosure can lead to inadvertent exfiltration of sensitive creative assets, proprietary branding, or personal information.
The skill explicitly sends user-supplied content and an access key to https://agent.deepnlp.org/agent_router, so external transmission is real. In this context the risk is not that transmission exists, but that the skill offers broad remote submission of potentially sensitive prompts and reference images with no stated minimization, consent, or trust boundary guidance.
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key
curl -X POST "https://agent.deepnlp.org/agent_router" \
-H "Content-Type: application/json" \
-H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
-d '{
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
### Main Parameters
| Parameter | Type | Default | Supported IDs |
| -------------- |-------------|---------------------| --------------------------------------------------------------------------------------------------------------------------- |
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Parameter | Type | Default | Supported IDs |
| -------------- |-------------|---------------------| --------------------------------------------------------------------------------------------------------------------------- |
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Parameter | Type | Default | Supported IDs |
| -------------- |-------------|---------------------| --------------------------------------------------------------------------------------------------------------------------- |
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
| `closure` | string | `buttons` | `buttons`, `zipper`, `snap`, `tie` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
| `closure` | string | `buttons` | `buttons`, `zipper`, `snap`, `tie` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
| `closure` | string | `buttons` | `buttons`, `zipper`, `snap`, `tie` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
| `closure` | string | `buttons` | `buttons`, `zipper`, `snap`, `tie` |
| `pocket` | string | `none` | `none`, `chest`, `double` |
| `cuff` | string | `standard` | `standard`, `button`, `french` |
| `colors` | object | — | Garment colors; existing nested state structure |
| `print_text` | string | `"Craftsman Agent"` | Global/legacy print text |
No suspicious patterns detected.