3D Maker Companion

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:25 AM UTC
• Version: 1.0.2

Overview

The skill is purpose-aligned for Meshy-based 3D workflows, but it needs review because it encourages insecure local storage of a Meshy API key.

Install only if you are comfortable with a local Meshy API helper. Prefer setting MESHY_API_KEY in your environment or a secret manager instead of using set-key, and do not commit or share any generated .env file. Expect prompts and image URLs you submit through the helper to be sent to Meshy.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/meshy_client.py:34

Finding

API Key Exposure Through Command-Line Arguments and Insecure Plaintext Storage

Content

View full analysis

Vulnerability Details

File Location: scripts/meshy_client.py:34-38, scripts/meshy_client.py:82-83, and SKILL.md:41
Vulnerability Type: Plaintext sensitive-data storage and command-line secret exposure
Risk Level: Medium

Vulnerable code and documentation:

scripts/meshy_client.py:34-38:

python

def set_key(api_key):
    env_path = os.path.join(os.path.dirname(__file__), "..", ".env")
    with open(env_path, "w") as f:
        f.write(f"MESHY_API_KEY={api_key}\n")
    print(f"API key saved to {env_path}")

scripts/meshy_client.py:82-83:

python

elif command == "set-key":
    set_key(sys.argv[2])

SKILL.md:41:

markdown

- **API Key:** Requires `MESHY_API_KEY`. Save locally: `python scripts/meshy_client.py set-key YOUR_KEY`.

Technical Analysis

The documented setup procedure requires the Meshy API key to be supplied as a command-line argument. Command-line secrets may be retained in shell history and can be exposed through process-inspection mechanisms while the command is running.

The set_key function subsequently writes the credential in plaintext to the project-level .env file. The file is opened using the process's default permissions, and the implementation does not explicitly enforce owner-only access. Its effective permissions therefore depend on the caller's umask and surrounding filesystem configuration. The file could also be unintentionally copied, archived, or committed to source control because no version-control exclusion is documented in the audited files.

Exploitation requires local access, access to shell history or process metadata, access to an inadequately protected project directory, or accidental disclosure of the .env file. No remote mechanism for reading this credential was identified in the audited code.

Attack Path

1. A user follows the documented command and supplies the API key as `python scripts/meshy_client.py se ...[truncated 1091 chars]

Remediation

View remediation

Remediation Suggestions

• Remove support for passing API keys directly through command-line arguments.
• Read interactive secrets using getpass.getpass() so they are not echoed or placed in shell history.
• Prefer retrieving the credential from a dedicated operating-system secret store or secrets-management service.
• If a local file must be supported, create it atomically with owner-only permissions such as mode 0600.
• Refuse to use a credential file whose owner or permissions are unsafe.
• Add .env to the project's version-control ignore rules and document that it must not be committed, archived, or shared.
• Avoid printing sensitive values and provide clear key-rotation instructions for users who may already have exposed a credential.
• Consider replacing the command with an interactive setup flow that validates permissions before writing the secret.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:14

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:8-17, specifically SKILL.md:14
Vulnerability Type: Unpinned and non-reproducible dependency installation
Risk Level: Low

Vulnerable configuration:

yaml

"install":
  [
    {
      "id": "pip-reqs",
      "kind": "exec",
      "command": "pip install requests",
      "label": "Install Python dependencies (requests)",
    },
  ],

Technical Analysis

The installation command retrieves requests without an exact version constraint, lock file, or integrity hash. Dependency resolution is therefore mutable: different installations can receive different versions of requests and its transitive dependencies.

This practice reduces build reproducibility and expands supply-chain risk. If a future package or transitive dependency release is compromised, removed, or incompatible, the installation command could retrieve it automatically. Package installation and later import execute code with the privileges of the user running the Skill.

The audited command uses the legitimate requests package name and the default package index; no dependency-confusion name, typosquatted package, or currently malicious version was identified. The finding concerns unsafe dependency resolution rather than evidence that the present dependency is malicious.

Attack Path

1. A user or automated Skill installer executes pip install requests.
2. Pip resolves the latest versions permitted at installation time, including transitive dependencies, without checking project-supplied hashes.
3. If a resolved release or its distribution channel has been compromised, malicious package code is downloaded.
4. Package installation hooks or imported runtime code execute under the installing user's account.
5. The malicious dependency can access files, environment variables, network resources, and other assets available to that account.

Impact Assessment

The pote ...[truncated 401 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive dependencies to reviewed versions in a lock file.
• Require package hashes, for example through a hash-locked requirements file and pip install --require-hashes.
• Periodically update pinned versions through a controlled dependency-review process rather than resolving mutable versions during installation.
• Install dependencies inside an isolated virtual environment instead of the global Python environment.
• Do not run package installation as an administrator or root user.
• Configure an approved package index and use automated vulnerability and provenance checks for dependency updates.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill’s declared purpose is mostly advisory for maker workflows, but the behavior includes undeclared credential handling by instructing users to persist an API key locally and enabling external service interaction. This mismatch is dangerous because users and platform policy may trust the skill as a benign workflow guide while it introduces higher-risk capabilities around secret storage and outbound communication that are not clearly scoped or justified by the stated functionality.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/meshy_client.py (reported line 14)May include surrounding context.

python

# Try environment variable first
    api_key = os.environ.get("MESHY_API_KEY")
    
    # Try local .env file in the skill directory
    if not api_key:
        try:
            env_path = os.path.join(os.path.dirname(__file__), "..", ".env")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/meshy_client.py (reported line 28)May include surrounding context.

python

# Try environment variable first
    api_key = os.environ.get("MESHY_API_KEY")
    
    # Try local .env file in the skill directory
    if not api_key:
        try:
            env_path = os.path.join(os.path.dirname(__file__), "..", ".env")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

The script reads credentials from a local .env file in the skill directory, which encourages storing secrets adjacent to project files and broadens exposure risk. In this context, the issue is not theft logic but insecure secret handling that can leak credentials via repository operations or local access.

Content

Scanner excerpt · scripts/meshy_client.py (reported line 17)May include surrounding context.

python

# Try local .env file in the skill directory
    if not api_key:
        try:
            env_path = os.path.join(os.path.dirname(__file__), "..", ".env")
            if os.path.exists(env_path):
                with open(env_path, "r") as f:
                    for line in f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This line writes the API key in plaintext to a .env file under the project tree. Plaintext credential storage materially increases the chance of credential compromise through accidental commits, local disclosure, backups, or other processes reading the file.

Content

Scanner excerpt · scripts/meshy_client.py (reported line 36)May include surrounding context.

python

}

def set_key(api_key):
    env_path = os.path.join(os.path.dirname(__file__), "..", ".env")
    with open(env_path, "w") as f:
        f.write(f"MESHY_API_KEY={api_key}\n")
    print(f"API key saved to {env_path}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares executable installation steps, requires an environment secret, and explicitly documents external network use, but it does not declare any tool scope or permissions boundaries. This creates an authorization gap where the skill can gain file, network, and secret access without transparent least-privilege controls, increasing the chance of unintended secret exposure or unsafe execution in agent environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/meshy_client.py (reported line 7)May include surrounding context.

python

import json
import time

API_URL_V1 = "https://api.meshy.ai/openapi/v1"
API_URL_V2 = "https://api.meshy.ai/openapi/v2"

def get_headers():

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/meshy_client.py (reported line 8)May include surrounding context.

python

import json
import time

API_URL_V1 = "https://api.meshy.ai/openapi/v1"
API_URL_V2 = "https://api.meshy.ai/openapi/v2"

def get_headers():

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script includes functionality to persist the Meshy API key into a local .env file in the skill directory. Storing credentials in plaintext on disk increases the risk of accidental exposure through source control, backups, shared workspaces, or other local users, and this persistence is not strictly necessary for the core maker-assistant workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The set_key command writes the supplied API key directly to a local .env file without confirmation, warning, or permission checks. This can cause users to unknowingly leave sensitive credentials in plaintext in a project directory where they may be committed, copied, or read by other tooling.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/meshy_client.py (reported line 47)May include surrounding context.

python

"prompt": prompt,
        "mode": mode
    }
    response = requests.post(f"{API_URL_V2}/text-to-3d", headers=headers, json=payload)
    return response.json()

def create_image_to_3d(image_urls, prompt=""):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/meshy_client.py (reported line 61)May include surrounding context.

python

"ai_model": "meshy-6",
        "object_prompt": prompt
    }
    response = requests.post(f"{API_URL_V1}/image-to-3d", headers=headers, json=payload)
    return response.json()

def get_task(task_id, version="v2"):

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The functions send user-provided prompt text and image URLs to the external Meshy API via HTTP requests. The file contains no docstring, comment, or user-facing notice explaining that supplied content will be transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.