generate-lego-3d-build-plan
What this skill does
The skill is a legitimate tool for generating LEGO 3D build plans by calling an external API (Craftsman Agent API OneKey Router). It is not a security or teaching tool, but a utility for interacting w
github/leoyeai - Exposure of API Keys - 2.1k stars
Threat analysis
Skill info
pkg:github/LeoYeAI/openclaw-master-skills@e5199b5?skill=generate-lego-3d-build-planAssessments (2)
Exposure of API Keys
Exposure of API Keys via local-llm-review
scripts/generate_lego_build_plan.py
The script uses the environment variable DEEPNLP_ONEKEY_ROUTER_ACCESS, which contains an API key. If this key is exposed (e.g., in logs, error messages, or shared environments), it could be misused.Insecure Default Timeout
Insecure Default Timeout via local-llm-review
scripts/generate_lego_build_plan.py
The script uses a default timeout of 60 seconds for API calls. While not a critical security issue, this could be a concern in environments where long-running requests are not expected or could lead tBadge
Add the Anomity scan badge for generate-lego-3d-build-plan to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of generate-lego-3d-build-plan? Report an issue or request a rescan.
