The Agent Skills Directory

[DATA_EXFILTRATION]: The skill retrieves the MESHY_API_KEY from the system environment or a local .env file in the current working directory. This key is used exclusively to authenticate HTTP requests to the official Meshy AI API endpoints (api.meshy.ai). This is a standard implementation for API-driven tools and does not involve exfiltration of unauthorized data.
[COMMAND_EXECUTION]: The scripts/slicers.py script employs the subprocess module to open generated 3D models in external slicing software such as OrcaSlicer or Bambu Studio. The implementation uses argument lists rather than shell strings, which mitigates common command injection risks.
[EXTERNAL_DOWNLOADS]: The skill downloads 3D assets (GLB, OBJ, 3MF) and associated thumbnails from meshy.ai domains. These downloads are initiated by user generation requests and are stored within a structured local meshy_output/ directory.
[PROMPT_INJECTION]: The skill ingests user-provided text prompts and external image URLs to generate 3D content. While this presents a surface for indirect prompt injection (where malicious data could be embedded in external assets or prompts), the skill includes mandatory human-in-the-loop confirmation steps for credit consumption and primarily processes binary model data, which reduces the risk of autonomous agent exploitation.
Ingestion points: User prompts via meshy_task.py and image URLs in pipelines.md.
Boundary markers: Explicit requirement to present cost summaries and await user confirmation before task creation.
Capability inventory: Subprocess execution in slicers.py, network requests via requests, and local file system writes in meshy_task.py.
Sanitization: Input prompts are limited in length (600 chars), and file system paths are sanitized using regex-based slugification.

meshy-openclaw