threejs-3d-generator
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a Python script
threejs_3d_asset.pyto interact with the Meshy API. This is the primary functionality and is documented clearly. - [CREDENTIALS_UNSAFE]: The skill includes instructions to probe shell profiles (
~/.zshrc,~/.zprofile) for theMESHY_API_KEY. This is used to assist users in configuring their environment for local development and does not exfiltrate the key value. - [EXTERNAL_DOWNLOADS]: The Python script downloads generated 3D assets (GLB, FBX, textures) from the official Meshy API (
https://api.meshy.ai) to a local project directory. These downloads are requested by the user during the asset generation workflow. - [DATA_EXFILTRATION]: The skill reads local image and model files to submit them to the Meshy API as base64-encoded data URIs. This is an intended part of the image-to-3D and retexturing features.
Audit Metadata