Meshy 3D Agent

• Outcome: Pass
• Latest audit: Oct 15, 2026 · 4:32 AM UTC
• Version: 0.7.0

Overview

This skill is a disclosed Meshy CLI workflow for creating and preparing 3D assets, with expected account login, uploads, downloads, and credit-spending behavior.

Install only if you are comfortable using Meshy as a third-party service for your prompts, images, models, and task metadata, and with the CLI reusing a stored Meshy session. Review the expected credit cost before approving a generation plan, and avoid providing confidential or proprietary assets unless you intend to upload them to Meshy.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

`npm exec --yes --package=meshy-cli@0.4.3 -- meshy`. No Python, no `curl`, no bundled scripts.

**Credentials:** the CLI's own browser sign-in (OAuth device flow) stores and refreshes a
session in `~/.config/meshy/credentials.json` (mode 0600). An existing `MESHY_API_KEY`, or an
explicit `--api-key-file`, is honoured and takes precedence. The skill never reads, prints or
copies a token, device code or key, and never asks for one in chat. `MESHY_API_KEY` is optional.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 175)May include surrounding context.

md

`npm exec --yes --package=meshy-cli@0.4.3 -- meshy`. No Python, no `curl`, no bundled scripts.

**Credentials:** the CLI's own browser sign-in (OAuth device flow) stores and refreshes a
session in `~/.config/meshy/credentials.json` (mode 0600). An existing `MESHY_API_KEY`, or an
explicit `--api-key-file`, is honoured and takes precedence. The skill never reads, prints or
copies a token, device code or key, and never asks for one in chat. `MESHY_API_KEY` is optional.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/printing.md (reported line 252)May include surrounding context.

bash

meshy creative-lab figure build create --input-task-id PROTOTYPE_ID --async --project "PROJECT_DIR" --stage build --workspace "WORKSPACE" --output-schema v1 --format json --no-update-check
meshy creative-lab lamp build create --input-task-id PROTOTYPE_ID --model-format stl --options '{"diameter_mm":180,"light_source_preset":"none"}' --async --project "PROJECT_DIR" --stage build --workspace "WORKSPACE" --output-schema v1 --format json --no-update-check
meshy creative-lab keychain build create --input-task-id PROTOTYPE_ID --model-format obj --options '{"size_mm":50}' --async --project "PROJECT_DIR" --stage build --workspace "WORKSPACE" --output-schema v1 --format json --no-update-check
meshy creative-lab fridge-magnet build create --input-task-id PROTOTYPE_ID --model-format obj --options '{"size_mm":60}' --async --project "PROJECT_DIR" --stage build --workspace "WORKSPACE" --output-schema v1 --format json --no-update-check
meshy creative-lab keycap build create --input-task-id PROTOTYPE_ID --candidate-id CANDIDATE_ID --async --project "PROJECT_DIR" --stage build --workspace "WORKSPACE" --output-schema v1 --format json --no-update-check
meshy creative-lab fidget-pixel build create --input-task-id PROTOTYPE_ID --async --project "PROJECT_DIR" --stage build --workspace "WORKSPACE" --output-schema v1 --format json --no-update-check

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 200)May include surrounding context.

so verify that branch with a free balance call instead:

bash

meshy balance --api-key-file ./.env --output-schema v1 --format json --no-update-check

The CLI reads only the key from that file. Do not source or display it. Never ask for an API

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 30)May include surrounding context.

md

- **Network failure during verification**: say it is a connectivity problem, keep the stored
  credential, and retry the check when the network is back. Do not start a new authorization.
- **Auth rejection**: use the login flow in [setup.md](setup.md). Do not clear all profiles.
- **Refresh failure**: a still-valid access token may keep working; an expired one cannot.
  Check connection/server errors before asking the user to authorize again.
- **Login code expired or denied**: rerun the same `auth login --device` for a fresh code, and
  show the new URL and code. Nothing paid is retried because a login timed out.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: meshy-openclaw
description: "Create 3D models, textures, reference images, rigging and animation with Meshy, and prepare models for physical 3D printing: white or multicolor prints, Creative Lab products, sizing and slicer handoff. Drives the Meshy CLI; signs in through the browser, no API key required."
license: MIT-0
metadata:
  openclaw:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/delivery.md (reported line 42)May include surrounding context.

meshy balance --output-schema v1 --format json --no-update-check

text

Spend rules: work already authorized by the user proceeds without asking again, stage by stage,
to the end of the agreed plan. Ask only for a **new** cost the user has not agreed to — an extra
stage, a second variant, a rerun after a disappointing result. Exit 9 (`insufficient_credit`)
stops new paid submissions immediately: keep everything already produced, report what is

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The pipeline directs the agent to perform paid create operations and subsequent downloads, but it does not require an explicit user-confirmation step immediately before incurring charges or sending data to Meshy. In an agent setting, that omission can cause unintended purchases or irreversible submissions based on ambiguous user requests, especially because the workflow is written as operational guidance rather than as a consent-gated procedure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The image/model ingestion workflow instructs the use of local file paths and URLs as inputs to Meshy without a clear warning that those assets will be uploaded or transmitted to a third-party service. That creates a real privacy and data-governance risk: users may provide proprietary models, personal photos, or confidential reference material without informed consent about external transfer and retention.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/setup.md (reported line 96)May include surrounding context.

md

### Keep the agent turn alive

After showing the link, your next action is to await the **same** running tool session.
Do not ask the user to send "done" or "continue", and do not end the turn with "authorize
and I will continue". Browser approval completes the CLI process; it is not a new user
message and must not be relied on to restart a finished agent turn.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/setup.md (reported line 121)May include surrounding context.

md

Do not create recurring automations or a second task to keep a login alive.

The process keeps polling until the user approves or the code expires. While it polls, do not
start a second login, do not kill it, and do not ask the user to paste anything. On approval it
writes `{"status":"logged_in", … "verified": true}` to stdout and exits 0. Then:

1. Re-run `auth status`; `verified: true` is the proof, not the exit code of `login`.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup.md (reported line 165)May include surrounding context.

md

command started. Keep one workspace per job: the project folder, task snapshots and delivered
files all live inside it. Say the output location when the job starts.

Existing files are never silently replaced: the CLI refuses to overwrite unless `--overwrite`
is passed, so an existing `chest.glb` is a decision — a new name or an explicit overwrite —
covered by what the user already authorized, not a silent clobber.

Static analysis

No suspicious patterns detected.