Security audit

toy-generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent toy-generation integration, but it documents unpinned npm command execution and weakly explains handling of private prompts, image URLs, credentials, and share links.

Install only if you are comfortable sending prompts, image URLs, generated assets, task metadata, and share links to the OneKey/Craftsman services. Prefer the REST examples or a pinned, reviewed `onekey` CLI version in a restricted environment, keep `DEEPNLP_ONEKEY_ROUTER_ACCESS` and returned share URLs private, and avoid submitting sensitive or proprietary designs without a clear data-handling agreement.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:204
Finding: Unpinned npm Package Execution Through npx
Content: View full analysis
Remediation: View remediation
agent ... ``` Do not use version ranges or tags such as `latest`. 2. Prefer declaring the CLI in a project manifest and committing the associated lockfile. Execute the locked local binary with: ```shell npm exec --offline -- onekey agent ... ``` 3. Use lockfile integrity metadata and a trusted, explicitly configured registry. In controlled environments, mirror the approved package and its transitive dependencies in an internal registry. 4. Document the package's official name, publisher, source repository, expected version, and release-verification procedure so users can detect namespace confusion or package replacement. 5. Review the selected package version and all transitive dependencies before approval. Re-run this review before upgrading. 6. Run the CLI in a restricted environment with minimum filesystem and network permissions. Supply the gateway credential only to the process that requires it and avoid exposing unrelated secrets through inherited environment variables. 7. Rotate `DEEPNLP_ONEKEY_ROUTER_ACCESS` promptly if execution of an untrusted package version is suspected, and review gateway usage records for unauthorized activity. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (32)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is designed to send user prompts, image URLs, and task data to external services through the OneKey gateway, but it does not clearly warn users that their content is transmitted to third-party infrastructure. In a skill handling user-provided creative assets, this can lead to unintended disclosure of sensitive or proprietary content.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.
text
| API | Description | | -------------------------- | ------------------------------------------------------------------------------------------- | | toy_generator_design_draft | Generate a toy design draft and multi-view reference sheets from text prompts and/or images | | toy_generator_task_create | Create a new Toy 3D Generation Task from images, prompts, and/or multi-view references |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
md
#### Requests Input Parameter | Parameter | Description | | ----------------- |-----------------------------------------------------------------------------------------------------------------------------------------| | prompt | Text prompt describing the desired toy | | images | Array of source image URLs used as visual references |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
| Parameter | Description | | ----------------- |-----------------------------------------------------------------------------------------------------------------------------------------| | prompt | Text prompt describing the desired toy | | images | Array of source image URLs used as visual references | | asset_size | Toy asset size, such as `small`, `standard`, or `premium` | | template_id | Toy template such as `figurine`, `stuffed-toy`, `3d-printing`, `game-assets`, or `architecture` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
md
| Parameter | Description | | ----------------- |-----------------------------------------------------------------------------------------------------------------------------------------| | prompt | Text prompt describing the desired toy | | images | Array of source image URLs used as visual references | | asset_size | Toy asset size, such as `small`, `standard`, or `premium` | | template_id | Toy template such as `figurine`, `stuffed-toy`, `3d-printing`, `game-assets`, or `architecture` | | provider_model_id | Toy design provider/model identifier; `default` is supported |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
| asset_size | Toy asset size, such as `small`, `standard`, or `premium` | | template_id | Toy template such as `figurine`, `stuffed-toy`, `3d-printing`, `game-assets`, or `architecture` | | provider_model_id | Toy design provider/model identifier; `default` is supported | | session_name | Name of the generated workspace session | | tag_list | Optional tags associated with the generation | | mode | Generation mode such as `basic`, `standard`, `advanced`, `demo`, Note that demo only return demo results not irrelevant to your inputs. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
| template_id | Toy template such as `figurine`, `stuffed-toy`, `3d-printing`, `game-assets`, or `architecture` | | provider_model_id | Toy design provider/model identifier; `default` is supported | | session_name | Name of the generated workspace session | | tag_list | Optional tags associated with the generation | | mode | Generation mode such as `basic`, `standard`, `advanced`, `demo`, Note that demo only return demo results not irrelevant to your inputs. | #### Input Parameter Options

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
**mode**: The mode as complexity of design for each generation task | mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
| mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
| mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
md
| mode | Description | |----------|----------------------------------------------------------------------------------------------------------------------| | basic | Basic Complexity for Design | | standard | Standard Complexity for Design | | advanced | Advanced Complexity for Design | | demo | Demo mode will only return predefined results for debug and APIs purpose, for production, please use other settings. |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
commandline
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.
commandline
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.
commandline
export DEEPNLP_ONEKEY_ROUTER_ACCESS=your_access_key curl -X POST "https://agent.deepnlp.org/agent_router" \ -H "Content-Type: application/json" \ -H "X-OneKey: $DEEPNLP_ONEKEY_ROUTER_ACCESS" \ -d '{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation instructs users to share or surface a share_url described as a private URL with keys, but it does not warn that possession of the link may grant access to generated content and workspace state. This can cause accidental exposure of private designs, prompts, images, or generated models if the link is forwarded or logged.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 81% confidence
Finding: The skill instructs users to invoke npx onekey without pinning a specific package version. This creates a supply-chain risk because future or compromised package versions could be fetched and executed implicitly at runtime.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.
md
#### Request Input Parameters | Parameter | Description | | ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.
md
| Parameter | Description | | ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`,`right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.
md
| ----------------- |---------------------------------------------------------------------------------------------------------------------------------------------| | session_id | Set Existing session_id the same as results from `toy_generator_design_draft` API in 1.1 section or Create a new separate session id (uuid) | | prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`,`right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.
md
| prompt | Text prompt describing the desired 3D toy | | images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`,`right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
md
| images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`,`right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 284)May include surrounding context.
md
| images | Array of source image URLs | | multi_view | Object containing multi-view image URLs. `front` is required when using multi-view generation; `left`,`right` and `back` can be supplied | | asset_size | Target toy asset size, depending on the selected template | | template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.
md
| template_id | Toy generation template | | provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session | | tag_list | Optional tags | | mode | Generation mode such as `basic`, `standard`, `advanced`, or `demo` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.
md
| provider_model_id | 3D generation provider, such as `tripo/tripo` or `meshy/meshy` | | model | Optional provider-specific model, such as `P1-20260311` or `v3.1-20260211` | | session_name | Name of the generation session | | tag_list | Optional tags | | mode | Generation mode such as `basic`, `standard`, `advanced`, or `demo` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.
md
#### Output Keys Definition | Key | Description | |----------------------|------------------------------------------------------------------------------------------------------------------------------------------| | provider_model_id | Selected 3D generation provider, e.g. tripo/tripo,meshy/meshy,etc. | | task_id | Unique ID of the created 3D generation task |