Security audit

Meshy AI

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Meshy.ai integration that sends user-chosen prompts or images to Meshy and saves generated files locally.

Install only if you are comfortable sending prompts and selected images to Meshy.ai using your Meshy API key. Prefer the default Meshy endpoint unless you deliberately trust a custom MESHY_BASE_URL, and choose an output directory where generated files may be written.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares behavior that uses environment variables and makes outbound network requests, but it does not declare permissions accordingly. This creates a transparency and governance gap: users or orchestrators may invoke the skill without realizing it accesses secrets and sends data to an external service.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs users to send prompts and images to the Meshy.ai API and download generated assets, but it does not clearly warn that user-supplied text and image inputs leave the local environment and are transmitted to a third party. This can cause inadvertent disclosure of sensitive prompts, proprietary images, or regulated data, especially because the skill emphasizes local output saving, which may give a false sense of purely local processing.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.