Meshy AI
v0.1.0Use the Meshy.ai REST API to generate assets: (1) text-to-2d (Meshy Text to Image) and (2) image-to-3d, then download outputs locally. Use when the user wants Meshy generations, needs polling async tasks, and especially when they want the resulting OBJ saved to disk. Requires MESHY_API_KEY in the environment.
⭐ 3· 1.9k·2 current·2 all-time
byDídac Sabatés@sabatesduran
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The code and SKILL.md implement a Meshy.ai client (text-to-image and image-to-3d) and require MESHY_API_KEY and optional MESHY_BASE_URL — this matches the description. However the registry metadata lists no required env vars/primary credential, which is inconsistent with the code and docs.
Instruction Scope
Runtime instructions are narrow and explicit: set MESHY_API_KEY (optional MESHY_BASE_URL), run the provided Python scripts, create tasks, poll until completion, and download returned URLs. The scripts only read local files you explicitly pass (for data-URI upload) and do network calls to the Meshy API and the returned model/image URLs.
Install Mechanism
No install spec (instruction-only + bundled Python scripts). Nothing is downloaded or executed at install time; risk is limited to running included Python scripts.
Credentials
The code requires a single API key (MESHY_API_KEY) and optionally MESHY_BASE_URL, which is appropriate for a REST API client. The registry metadata failing to declare this required env var is a discrepancy that should be corrected before trusting the metadata alone.
Persistence & Privilege
The skill does not request permanent presence (always=false) and does not modify other skills or system-wide settings. It can be invoked autonomously by the agent (platform default), which is expected for a callable skill.
Assessment
This skill appears to do exactly what it claims: it needs your Meshy API key, creates async jobs, polls for completion, and downloads images/OBJ files. Before installing or running: (1) ensure the registry metadata is corrected to list MESHY_API_KEY so you know what credentials are required; (2) only provide an API key you trust Meshy with (use limited-scope keys if available); (3) be aware downloads come from URLs returned by the service — avoid running untrusted binaries and inspect downloaded content before executing anything; (4) if you’ll run the scripts locally, run them in an isolated environment (container or VM) if you have concerns about third-party content. If you need higher assurance, request that the publisher add the required env var to the registry metadata and confirm the package's provenance/homepage.Like a lobster shell, security has layers — review code before you run it.
latestvk9763sv8qmdnxe9zyhh8xbjcwh7zsms1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.