meshyai
Warn
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to check for sensitive credentials in the local environment using the command
test -f .env && grep -q '^MESHY_API_KEY=.' .env && echo 'found'. It also instructs the agent to prompt users to provide their API key directly which is then stored in a.envfile. - [COMMAND_EXECUTION]: The skill makes heavy use of shell commands to manage environment variables (
set -a; . .env; set +a) and to execute local Node.js scripts (node scripts/meshy-generate.mjs). - [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and execute the@gltf-transform/clipackage at runtime for model optimization, which involves downloading code from the NPM registry and executing it.
Audit Metadata