meshyai

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill explicitly instructs the agent to ask the user to paste their MESHY_API_KEY into the conversation and shows commands like MESHY_API_KEY=<key> node ..., which requires the LLM to receive and may include secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill explicitly accepts and downloads arbitrary public image URLs for image-to-3d (see api-reference.md examples) and falls back to crawling/searching public model libraries (find-3d-asset, Sketchfab/Poly Haven) as part of its required generate/download pipeline, so untrusted third-party content is ingested and can influence generation and subsequent pipeline actions.