Meshy AI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:15 AM UTC
• Version: 0.1.0

Overview

This skill coherently uses Meshy.ai to generate images or 3D assets and save them locally, with a notable API-key handling footgun around custom base URLs.

Install only if you intend to use Meshy.ai and are comfortable sending prompts, images, and image URLs to that service. Keep MESHY_API_KEY private, do not set MESHY_BASE_URL unless you trust the endpoint, and avoid confidential images or prompts unless your Meshy account and data policy allow it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/meshy_client.py:42

Finding

Unvalidated API Base URL Can Expose the Meshy API Key

Content

View full analysis

Vulnerability Details

File Location: scripts/meshy_client.py, lines 42-62
Vulnerability Type: Credential disclosure through an unvalidated endpoint override
Risk Level: Medium

Vulnerable Code

python

def _headers_json() -> Dict[str, str]:
    api_key = _get_env("MESHY_API_KEY")
    return {
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json",
        "Accept": "application/json",
    }


def _base_url() -> str:
    return os.environ.get("MESHY_BASE_URL", DEFAULT_BASE_URL).rstrip("/")


def _request(method: str, path: str, *, body: Optional[dict] = None) -> Any:
    url = f"{_base_url()}{path}"
    data = None
    if body is not None:
        data = json.dumps(body).encode("utf-8")

    req = urllib.request.Request(url, method=method, headers=_headers_json(), data=data)

Technical Analysis

The application allows MESHY_BASE_URL to control the destination of authenticated API requests. It does not validate the URL scheme, hostname, port, user information, or other URL components before attaching the MESHY_API_KEY as a bearer token.

Consequently, an attacker who can influence the process environment or configuration can redirect requests to an attacker-controlled server. Because plaintext HTTP is also accepted, the token could additionally be exposed through network interception. Prompt text and Base64-encoded local image content included in request bodies would be sent to the same unauthorized endpoint.

Attack Path

1. An attacker gains the ability to influence the environment or configuration used to launch either generation script.
2. The attacker sets MESHY_BASE_URL to an endpoint under their control, such as http://attacker.example.
3. A user invokes scripts/text_to_image.py or scripts/image_to_3d_obj.py.
4. _request() constructs the API URL from the attacker-controlled base URL.
5. _headers_json() attaches `A ...[truncated 766 chars]

Remediation

View remediation

Remediation Suggestions

• Remove MESHY_BASE_URL support if custom endpoints are not operationally necessary.
• If an override is required, parse it with urllib.parse.urlsplit and require the https scheme.
• Maintain an explicit allowlist of trusted Meshy API hostnames and reject all other destinations before constructing authenticated requests.
• Reject URLs containing user information, fragments, unexpected ports, or ambiguous host representations.
• Attach the Authorization header only after the final request destination has passed validation.
• Ensure redirects cannot forward the authorization header to a different origin. Disable redirects or validate every redirect destination before following it.
• Avoid logging the bearer token and rotate the Meshy API key immediately if it may have been exposed.
• Document the security implications of endpoint overrides and ensure untrusted users cannot modify the execution environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description claims the skill supports both (1) text-to-2d and (2) image-to-3d, and emphasizes downloading the resulting OBJ locally. However, this code chunk exclusively handles the text-to-image endpoint (/openapi/v1/text-to-image), polls that task, and downloads PNG images from image_urls. There is no image-to-3d endpoint usage, no handling of 3D model task results, and no OBJ file download or save logic. Resource access and environment variable usage are consistent with Meshy, and there is no evidence of unrelated or undeclared capabilities. The mismatch is that the declared purpose overstates the implemented functionality for this code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation describes use of environment secrets and outbound network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: consumers cannot easily tell that the skill will read MESHY_API_KEY and transmit data to an external service, increasing the chance of unintended secret use or network-enabled misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to submit prompts, local images, and image URLs to a third-party API, but it does not explicitly warn that this data leaves the local environment over the network. This omission can lead users to unknowingly upload sensitive proprietary images or confidential prompt content to Meshy.ai, creating privacy, compliance, and data-handling risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The markdown explains that scripts create remote Meshy.ai tasks and download outputs locally, and later instructs users to set an API key and submit prompts or images. However, it does not include any explicit user warning about sending inputs to a third-party API or saving generated assets to disk, which are behaviors that can affect privacy and local data handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.