add-3d-assets

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs prompting the user to paste the MESHY_API_KEY and shows/uses commands like MESHY_API_KEY=<key> node ... and saving it to .env, which requires the agent to accept and embed the secret verbatim in commands or files (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly downloads and integrates models from third-party services (Meshy via its API and public libraries like Poly Haven and Sketchfab — e.g., the scripts and commands in "Step 4: Generate / Download" and the node <plugin-root>/scripts/find-3d-asset.mjs --source polyhaven flow), and then reads model files/.meta.json and uses those assets to decide loading, configuration, and runtime behavior, exposing the agent to untrusted user-generated web content that could influence actions.