Image To 3d Pipeline

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

A user or agent could be led to provide and use an unexpected third-party API token, potentially sending image jobs to a different paid service than expected.

Why it was flagged

The declared credentials omit MESHY_API_KEY, but the documented workflow uses that key to call Meshy, a different provider from the advertised Tripo3D/Replicate flow.

Skill content

"env": ["TRIPOSR_API_KEY"], "optional": ["REMOVE_BG_API_KEY", "UPSCALE_API_KEY"] ... "https://api.meshy.ai/v2/image-to-3d/$TASK_ID" ... "Authorization: Bearer $MESHY_API_KEY"

Recommendation

Declare MESHY_API_KEY and the Meshy provider explicitly, including cost and data-flow expectations, or remove the Meshy steps and align the workflow with the declared Tripo/Replicate credential.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Running the batch example without checking the image list and pricing could consume credits, create charges, or upload more product images than intended.

Why it was flagged

The skill documents a parallel batch submission loop. This is related to the image-to-3D purpose, but it can submit multiple paid API jobs and upload multiple image URLs if run as written.

Skill content

for img in "${images[@]}"; do
  curl -X POST "https://api.meshy.ai/v2/image-to-3d" \
    -H "Authorization: Bearer $MESHY_API_KEY" ... &
done

Recommendation

Use batch mode only with explicit user confirmation, reviewed image inputs, provider choice, rate limits, and cost limits.