meltflex-3d
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of user-supplied image URLs and structured JSON responses from the MeltFlex API. Ingestion points include the imageUrl input and the pollUrl, modelUrl, and spzUrl fields from the API. The skill uses the requests library and standard file I/O to handle this data. No explicit boundary markers or input sanitization logic are demonstrated in the documentation snippets, though the risk is minimized by the binary nature of the primary assets.
- [EXTERNAL_DOWNLOADS]: The skill interacts with external domains to download generated 3D assets (GLB and SPZ files). These downloads target MeltFlex infrastructure and associated third-party services including meshy.ai and worldlabs.ai. These are well-known services within the 3D AI industry and are required for the skill's primary functionality.
Audit Metadata