ClawHub

Meshy 3D Agent

v0.1.1

Generate 3D models, textures, images, rig characters, animate them, and prepare for 3D printing using the Meshy AI API. Handles API key detection, task creat...

⭐ 1· 115·0 current·0 all-time
by@arlieeee
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (3D generation, text/image→3D, rigging, printing) align with the declared requirements: python3 + curl, a single service API key (MESHY_API_KEY), and the requests library. No unrelated cloud creds, system config paths, or unusual binaries are requested.
✓
Instruction Scope
SKILL.md explicitly limits environment/file access to the current session env and a .env in the current working directory, plus files the user explicitly provides. It documents network endpoints (api.meshy.ai) and describes create→poll→download flows. The only scope caveat is that persisting the API key to .env (allowed only when the user requests it) will store secrets on disk — the skill documents this and recommends adding .env to .gitignore.
ℹ
Install Mechanism
Install spec lists a single dependency (requests). This is proportionate. The installer kind is shown as 'uv' which is uncommon/ambiguous in the metadata — likely intended to ensure requests is available (pip install requests), but you should confirm what the platform's 'uv' install step will actually execute before allowing installation.
✓
Credentials
Only one credential (MESHY_API_KEY) is required and declared as the primary credential. The SKILL.md explains how the key is used (Authorization header) and restricts where it will be read/written (current working directory .env only). This is proportionate to the skill's purpose. Note: writing the key to .env is optional but would persist the secret on disk — follow the guidance to add .env to .gitignore if you persist it.
✓
Persistence & Privilege
Skill is not always-enabled and uses normal autonomous-invocation defaults. It does not request system-wide config changes, other skills' configs, or access to system-protected paths. It will create a meshy_output/ directory in the current working directory to store outputs, which is reasonable for this functionality.
Assessment
This skill is internally consistent: it only needs an API key for Meshy, Python + requests, and curl to call the Meshy REST API and save outputs locally. Before installing: (1) confirm what the platform's 'uv' installer will run (ensure it is just installing the requests package), (2) be cautious about persisting MESHY_API_KEY to a .env file — only do so if you understand the project-level secret storage risk and add .env to .gitignore, and (3) verify you trust https://api.meshy.ai because any requests to that endpoint will include your API key. If you prefer not to persist the key, keep it set only in the session environment. If you want more assurance, request the exact install steps that will run for the 'uv' installer and proof that no other network endpoints are contacted.

Like a lobster shell, security has layers — review code before you run it.

latestvk971ehkpcte6je2zyp28ej6cm1833whz

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binspython3, curl
EnvMESHY_API_KEY
Primary envMESHY_API_KEY

Install

uvuv tool install requests

Comments