The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it instructs the agent to interpolate user-provided text prompts and external resource URLs (images and 3D models) directly into API requests.
Ingestion points: The prompt, texture_prompt, image_url, and model_url parameters in the Meshy API examples (found in SKILL.md) serve as entry points for untrusted data.
Boundary markers: The skill lacks explicit instructions for the agent to use delimiters or ignore potentially malicious instructions embedded within the user-supplied input.
Capability inventory: The skill uses curl for network operations to api.meshy.ai across all its functional examples.
Sanitization: There is no mention of sanitizing or validating the input data before it is sent to the external service.

meshy-3d