Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a remote clothing-design integration, but its hoodie-specific name understates broader clothing scope and it uses external services and an unpinned CLI path with limited privacy disclosure.
Install only if you are comfortable sending design prompts, reference image URLs, logos, and related metadata to the Craftsman/DeepNLP remote service. Treat it as a general clothing designer, not just a hoodie designer, and prefer the documented REST call or a pinned/trusted CLI version instead of the unpinned npx example.
The skill is presented as a hoodie/sweatshirt designer, but the body of the documentation describes a broad clothing-design capability spanning many unrelated garment categories. This scope mismatch can cause overbroad tool use, weaker policy enforcement, and unintended transmission of user data to external endpoints for tasks outside the declared purpose.
The workflow explicitly includes sending user designs to a factory but provides no warning that user-submitted designs, logos, or potentially sensitive commercial material may be disclosed to an external third party. In a design tool context, that can expose proprietary artwork, branding assets, or personal customization data without informed consent.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
[Manufacturing on Demand Send Designs to Factory]
| API | Description |
|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
| clothing_generator_design_draft | Generate Design Draft of your preferred Clothing type, e.g. shirts, texture, dimension, customized text and logo for printing. |
The documentation encourages sending prompts and image URLs to a remote service without a privacy warning or consent language. Because prompts and reference images may contain personal data, proprietary designs, or copyrighted material, silent transmission to an external API creates a real confidentiality risk.
The documented API accepts many non-hoodie template_id values despite the skill metadata claiming a hoodie-specific purpose. This expands the operational scope beyond what orchestrators or users may expect, increasing the chance of inappropriate invocation, excessive permissions, and unintended external sharing of prompts and images.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
#### Requests Input Parameter
| Parameter | Description |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `prompt` | Text description of the desired clothing style, material, fit, dimensions, decoration, printing, personalization, or manufacturing intent |
| `images` | Array of source image URLs used as visual references |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Parameter | Description |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `prompt` | Text description of the desired clothing style, material, fit, dimensions, decoration, printing, personalization, or manufacturing intent |
| `images` | Array of source image URLs used as visual references |
| `template_id` | Clothing template ID such as `t-shirt`, `shirt`, `polo-shirt`, `hoodie`, `jacket`, `coat`, `dress`, `skirt`, `pants`, `jeans`, `shorts`, `hat`, `scarf`, `gloves`, or `socks` |
| `options` | Structured customization parameters defined by the selected clothing template |
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `prompt` | Text description of the desired clothing style, material, fit, dimensions, decoration, printing, personalization, or manufacturing intent |
| `images` | Array of source image URLs used as visual references |
| `template_id` | Clothing template ID such as `t-shirt`, `shirt`, `polo-shirt`, `hoodie`, `jacket`, `coat`, `dress`, `skirt`, `pants`, `jeans`, `shorts`, `hat`, `scarf`, `gloves`, or `socks` |
| `options` | Structured customization parameters defined by the selected clothing template |
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
| `session_name` | Name of the generated workspace session |
| `tag_list` | Optional tags associated with the generation |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `images` | Array of source image URLs used as visual references |
| `template_id` | Clothing template ID such as `t-shirt`, `shirt`, `polo-shirt`, `hoodie`, `jacket`, `coat`, `dress`, `skirt`, `pants`, `jeans`, `shorts`, `hat`, `scarf`, `gloves`, or `socks` |
| `options` | Structured customization parameters defined by the selected clothing template |
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
| `session_name` | Name of the generated workspace session |
| `tag_list` | Optional tags associated with the generation |
| `mode` | Generation mode: `basic`, `standard`, `advanced`, or `demo` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `template_id` | Clothing template ID such as `t-shirt`, `shirt`, `polo-shirt`, `hoodie`, `jacket`, `coat`, `dress`, `skirt`, `pants`, `jeans`, `shorts`, `hat`, `scarf`, `gloves`, or `socks` |
| `options` | Structured customization parameters defined by the selected clothing template |
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
| `session_name` | Name of the generated workspace session |
| `tag_list` | Optional tags associated with the generation |
| `mode` | Generation mode: `basic`, `standard`, `advanced`, or `demo` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `options` | Structured customization parameters defined by the selected clothing template |
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
| `session_name` | Name of the generated workspace session |
| `tag_list` | Optional tags associated with the generation |
| `mode` | Generation mode: `basic`, `standard`, `advanced`, or `demo` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `provider_model_id` | Clothing design provider/model identifier; `default` is supported |
| `session_name` | Name of the generated workspace session |
| `tag_list` | Optional tags associated with the generation |
| `mode` | Generation mode: `basic`, `standard`, `advanced`, or `demo` |
#### Input Parameter Options
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
**mode**: The mode as complexity of design for each generation task
| ID | Description |
| ---------- | ------------------------------------------------------------------------------------------------------------ |
| `basic` | Basic complexity for design |
| `standard` | Standard complexity for design |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| ID | Description |
| ---------- | ------------------------------------------------------------------------------------------------------------ |
| `basic` | Basic complexity for design |
| `standard` | Standard complexity for design |
| `advanced` | Advanced complexity for design |
| `demo` | Demo mode for predefined/debug API results; use `basic`, `standard`, or `advanced` for production generation |
The documented curl request sends user-provided prompt data, image references, and an access token to an external endpoint. External transmission is inherent to the service design, but it is security-relevant because sensitive creative assets and credentials may leave the local environment and be processed by a third party.
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key
curl -X POST "https://agent.deepnlp.org/agent_router" \
-H "Content-Type: application/json" \
-H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \
-d '{
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
### Main Parameters
| Parameter | Type | Default | Supported IDs |
| -------------- |-------------|---------------------| --------------------------------------------------------------------------------------------------------------------------- |
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Parameter | Type | Default | Supported IDs |
| -------------- |-------------|---------------------| --------------------------------------------------------------------------------------------------------------------------- |
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Parameter | Type | Default | Supported IDs |
| -------------- |-------------|---------------------| --------------------------------------------------------------------------------------------------------------------------- |
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `gender` | string | `unisex` | `male`, `female`, `unisex`, `kids` |
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
| `closure` | string | `buttons` | `buttons`, `zipper`, `snap`, `tie` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `sub_category` | string | `casual-shirt` | `dress-shirt`, `casual-shirt`, `oxford`, `oversized`, `crop-shirt`, `tunic`, `blouse` |
| `material` | string | `default` | `default`, `cotton`, `organic-cotton`, `linen`, `silk`, `rayon`, `polyester`, `oxford`, `poplin`, `flannel`, `cotton-blend` |
| `asset_size` | string | `default` | `default`, `xs`, `s`, `m`, `l`, `xl` |
| `fit` | string | `regular` | `slim`, `regular`, `relaxed`, `oversized` |
| `collar` | string | `point` | `point`, `spread`, `mandarin`, `peter-pan`, `button-down`, `no-collar` |
| `sleeve` | string | `short` | `short`, `long`, `puff`, `bell`, `bishop`, `sleeveless` |
| `closure` | string | `buttons` | `buttons`, `zipper`, `snap`, `tie` |
No suspicious patterns detected.