ClawHub

Meshy Openclaw

v0.1.1

Generate 3D models, textures, images, rig characters, animate them, and prepare for 3D printing using the Meshy AI API. Handles API key detection, task creat...

⭐ 0· 97·0 current·0 all-time
by@arlieeee·duplicate of @arlieeee/meshy-3d-agent (0.1.0)
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the actual behavior: it connects to https://api.meshy.ai, creates/polls tasks, downloads model assets, and prepares local output. Requested binaries (python3, curl), the single env var (MESHY_API_KEY), and the lightweight requests dependency are appropriate for a Meshy API integration.
ℹ
Instruction Scope
SKILL.md stays within the declared scope (interacts only with api.meshy.ai, current working directory .env, and user-specified input files). However, the provided detection script echoes the first 8 characters of MESHY_API_KEY to stdout (e.g., ENV_VAR: FOUND (msy_12345678...)), which contradicts the 'Never logged' claim and could expose part of the key in logs/agent transcripts. The skill also instructs saving the full key to .env when the user requests persistence (explicit user action).
✓
Install Mechanism
Install spec only requests the 'requests' Python package (via a 'uv' entry). This is a minimal, expected dependency for making HTTP calls. No remote archives or arbitrary downloads are requested.
ℹ
Credentials
Only MESHY_API_KEY is required and declared as the primary credential, which is proportional. The minor concern is the partial-key echo to stdout and the optional persistence to a local .env file; both are explained in the manifest but could expose secrets if logs or the .env file are not handled carefully.
✓
Persistence & Privilege
The skill does not request always:true, does not require system-level changes, and confines file writes to the current working directory (meshy_output/ and an optional .env) per its manifest. No modifications to other skills or system configs are requested.
Assessment
This skill appears to do what it says and only needs your Meshy API key and Python's requests package. Before installing: 1) Prefer providing the API key for the current session instead of persisting it to .env unless you understand the risk. 2) If you persist the key, add .env to .gitignore to avoid accidental commits. 3) Be aware the skill prints the first ~8 characters of your key to stdout — these partial values can appear in logs or transcripts, so avoid sharing those logs. 4) Only install if you trust the Meshy API endpoint and are comfortable granting one API key to the skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk9715cmkd6m4x79nz13bwsxct1833m1t

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binspython3, curl
EnvMESHY_API_KEY
Primary envMESHY_API_KEY

Install

uvuv tool install requests

Comments