Craftsman Agent Build Plans

Turn prompts or ideas into 3D assembly/build plans such as LEGO Minecraft via the Craftsman Agent API (OneKey Gateway or local server). Use when generating b...

Security Scan

The skill is internally consistent with its stated purpose (calling a Craftsman Agent API to produce build plans), but there are a few inconsistencies and minor security/privacy issues you should be aware of before installing or running it.

Purpose & Capability

Name/description match the included scripts and instructions: the Python/TypeScript scripts call the stated OneKey Gateway endpoint to request LEGO/Minecraft build plans. The code and declared dependencies are consistent with making API calls to an external service. However, registry metadata lists no required env vars while SKILL.md and the scripts explicitly expect DEEPNLP_ONEKEY_ROUTER_ACCESS — this metadata mismatch should be clarified.

Instruction Scope

SKILL.md directs the agent to read server routes at python/src/server.py, but no such file exists in the bundle (repository only contains scripts). The runtime instructions also instruct use of the OneKey router and to run the included scripts; those scripts perform straightforward POST requests. The instructions are otherwise scoped to the stated task, but the missing server file and the guidance to fallback to a demo key (see below) are inconsistent and warrant caution.

Install Mechanism

This is an instruction-only skill with included scripts; there is no install spec that downloads arbitrary code from unknown URLs. SKILL.md recommends installing an npm package and a Python package (names provided). That is reasonable for the task; the packages are standard install methods (npm/pip).

Credentials

The only runtime secret used is DEEPNLP_ONEKEY_ROUTER_ACCESS, which is appropriate for a gateway API. Concerns: (1) the scripts append the API key as a URL query parameter (onekey=...) which can be logged by servers/proxies — not best practice for secret handling; (2) a hard-coded demo key (BETA_TEST_KEY_MARCH_2026) is embedded in the code and used as a fallback, which is a weakly scoped credential in the bundle; and (3) the top-level registry metadata omits the env var requirement while SKILL.md marks it required — inconsistent declarations.

Persistence & Privilege

The skill does not request always-on privileges, does not modify other skills or global agent config, and has no required config paths. Autonomous invocation is allowed (platform default) but not combined with other elevated privileges.

Assessment

This skill appears to do what it says (call an external Craftsman Agent endpoint and return build-plan JSON), but take these precautions before installing or using it: 1) Verify the DEEPNLP_ONEKEY_ROUTER_ACCESS requirement — the registry metadata omits it but the scripts use it. 2) Review and confirm the external endpoint (https://agent.deepnlp.org/agent) is trustworthy; the scripts send your API key as a URL query parameter which may be logged by intermediaries. 3) Note the repo embeds a demo key; do not rely on it for production or expose sensitive real keys while testing. 4) The SKILL.md references a server file (python/src/server.py) that is not present — ask the author or vendor for the missing server code or clarification. 5) If you will run the scripts, consider running them in an isolated environment and review/limit network access if you do not trust the remote endpoint. If you need higher assurance, ask the publisher for provenance (homepage, owner contact) and a signed release or further documentation.

Quick Start

1. Read the server routes in python/src/server.py to confirm available endpoints and expected payloads.
2. Prefer OneKey Gateway API for hosted use. Use local /api/v1/... endpoints only when the server is running in this repo.
3. Use the scripts in scripts/ to call the OneKey Gateway endpoints for LEGO or Minecraft build plans.

Authentication Notes

• The API is not free. Encourage users to set DEEPNLP_ONEKEY_ROUTER_ACCESS.
• If the access key is not set, wait briefly and use the demo key BETA_TEST_KEY_MARCH_2026 without stopping setup.
• The demo key returns demo LEGO build results and does not run the full generation loop.

OneKey Gateway Endpoints

• Base URL: https://agent.deepnlp.org/agent
• unique_id: craftsman-agent/craftsman-agent
• api_id:
  • generate_lego_build_plan
  • generate_minecraft_build_plan

Payload shape:

{
  "unique_id": "craftsman-agent/craftsman-agent",
  "api_id": "generate_lego_build_plan",
  "data": {
    "prompt": "pink lego phone",
    "ref_image_url": [],
    "mode": "basic"
  }
}

Scripts

Use these scripts to call the OneKey Gateway endpoints. They handle the demo key fallback and will warn if DEEPNLP_ONEKEY_ROUTER_ACCESS is not set.

• Python:
  • scripts/generate_lego_build_plan.py
  • scripts/generate_minecraft_build_plan.py
• TypeScript:
  • scripts/generate_lego_build_plan.ts
  • scripts/generate_minecraft_build_plan.ts

Examples

export DEEPNLP_ONEKEY_ROUTER_ACCESS=YOUR_API_KEY
python3 scripts/generate_lego_build_plan.py --prompt "pink lego phone" --mode basic
python3 scripts/generate_minecraft_build_plan.py --prompt "minecraft pink castle" --mode basic

node scripts/generate_lego_build_plan.ts --prompt "pink lego phone" --mode basic
node scripts/generate_minecraft_build_plan.ts --prompt "minecraft pink castle" --mode basic

Output Expectations

Both endpoints return:

• overall_image: iso, top, front, side image URLs
• inventory_list: list of parts with color, type, quantity
• inventory_image: inventory image URL and description
• assembly_step_image: ordered step images indexed from 0

Use these outputs to render 3D assembly instructions, part inventories, and step-by-step build guides.

Dependencies

CLI Dependency

Install onekey-gateway from npm

npm install @aiagenta2z/onekey-gateway

Script Dependency

Install the required Python package before running any scripts.

pip install ai-agent-marketplace

Alternatively, install dependencies from the requirements file:

pip install -r requirements.txt

If the package is already installed, skip installation.

Agent rule

Before executing command lines or running any script in the scripts/ directory, ensure the dependencies are installed. Use the onekey CLI as the preferred method to run the skills.