generate-lego-3D-build-plan
Warn
Audited by Snyk on Mar 30, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill sends user prompts and user-supplied public image URLs to an external OneKey Router API at https://agent.deepnlp.org/agent_router (see SKILL.md and scripts/generate_lego_build_plan.{py,ts}), then parses the API's JSON response as the build plan, so it clearly ingests untrusted third-party content that can directly determine instructions and outputs.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata