Tripo 3d

• Analyzed: May 15, 2026, 5:06 AM
• Findings: 1
• Version: 2.0.5
• Hash: dafff139807842cc0b84e8335ae92be181e62e9325c14ad02c185c2b79144d57
• Source: palm
• External report: View on VirusTotal

Findings (1)

The tripo-3d-generation skill is a legitimate integration for Tripo AI services, supporting text-to-3D and image-to-3D workflows. It implements a dual-channel communication strategy: direct requests to api.tripo3d.ai when a user provides their own API key, and proxied requests to skills.vast-internal.com for a free tier. The code (index.mjs) uses a local file (~/.tripo-skill-id) to store a random UUID for anonymous quota tracking, which is clearly documented in the security section of SKILL.md. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.