craftsman-agent-build-plans
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and installs standard packages from official registries (NPM and PyPI). Specifically, it uses
@aiagenta2z/onekey-gatewayandai-agent-marketplace. These appear to be vendor-provided tools for the Craftsman Agent service. - [CREDENTIALS_UNSAFE]: The skill uses an environment variable
DEEPNLP_ONEKEY_ROUTER_ACCESSto manage its API key, which is a recommended security practice. While it mentions a demo keyBETA_TEST_KEY_MARCH_2026in the documentation, this is presented as a public testing credential for restricted demo functionality and does not represent a sensitive secret exposure. - [COMMAND_EXECUTION]: The skill executes installation commands (
npm install,pip install) and scripts provided within the skill package. These commands are necessary for the skill's primary function and are explicitly documented. - [DATA_EXFILTRATION]: The skill sends user-provided prompts and image URLs to the official vendor endpoint
https://agent.deepnlp.org/agent_router. This behavior is the intended purpose of the skill and the destination matches the service provider's domain. No sensitive local files are accessed or transmitted.
Audit Metadata