Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Tripo3D API helper skill whose network uploads, API token use, polling, and downloads match its stated 3D model generation purpose.
Install only if you intend to use Tripo3D as a third-party generation service. Treat prompts and uploaded images as data sent to Tripo3D, keep TRIPO3D_API_KEY in an environment variable, and confirm the exact image files and download destination before running upload or download steps.
This skill is designed to communicate with an external service, so network transmission is expected; however, it still represents a real data egress boundary because prompts, images, tokens, and task metadata are sent to Tripo3D. Without clear guardrails, an agent could transmit sensitive user content to a third party.
https://api.tripo3d.ai/v2/openapi
All requests require header:
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Description |
|------|-------------|
| text_to_model | Text prompt → 3D model |
| image_to_model | Single image → 3D model |
| multiview_to_model | 4 images (front/left/back/right) → 3D model |
| refine_model | Refine an existing draft model |
Step 1 — Create task
POST /v2/openapi/task
{
"type": "text_to_model",
"prompt": "a fierce tiger with orange and black stripes"
}
Step 2 — Poll status
GET /v2/openapi/task/{task_id}
Poll every 5–10 seconds. Done when status === "success".
Step 3 — Download model
From response: data.output.pbr_model.url
Step 1 — Upload image (STS)
POST /v2/openapi/upload/sts
Content-Type: multipart/form-data
Form field: file (JPEG/PNG/WEBP, max 10MB, min 256px)
Response:
{ "code": 0, "data": { "image_token": "uuid-xxx" } }
Step 2 — Create image-to-3D task
POST /v2/openapi/task
The skill instructs users to upload local images to a third-party API and to download generated files to disk, but it does not clearly warn that user-provided content leaves the local environment or that files will be created locally. In an agent setting, this can cause unintended disclosure of sensitive images or unexpected local file writes if the user has not explicitly consented.
The upload example shows sending a local file to an external endpoint, which is functionally necessary for the skill but still creates a concrete exfiltration path for user files. In a multi-tool agent environment, examples like this can normalize unsafe file transfer unless the skill explicitly scopes acceptable inputs and consent requirements.
'Authorization' = 'Bearer <API_KEY>'
}
$filePath = "C:/path/to/image.jpg"
$response = Invoke-RestMethod -Uri 'https://api.tripo3d.ai/v2/openapi/upload/sts' `
-Method POST `
-Headers $headers `
-ContentType 'multipart/form-data' `