Meshy AI

Use the Meshy.ai REST API to generate assets: (1) text-to-2d (Meshy Text to Image) and (2) image-to-3d, then download outputs locally. Use when the user wants Meshy generations, needs polling async tasks, and especially when they want the resulting OBJ saved to disk. Requires MESHY_API_KEY in the environment.

Security Scan

The skill is internally consistent with its stated purpose (Meshy.ai client to create async tasks and download image/OBJ outputs); the only notable issue is registry metadata not declaring the required MESHY_API_KEY, which looks like an oversight rather than malicious behavior.

Purpose & Capability

The code and SKILL.md implement a Meshy.ai client (text-to-image and image-to-3d) and require MESHY_API_KEY and optional MESHY_BASE_URL — this matches the description. However the registry metadata lists no required env vars/primary credential, which is inconsistent with the code and docs.

Instruction Scope

Runtime instructions are narrow and explicit: set MESHY_API_KEY (optional MESHY_BASE_URL), run the provided Python scripts, create tasks, poll until completion, and download returned URLs. The scripts only read local files you explicitly pass (for data-URI upload) and do network calls to the Meshy API and the returned model/image URLs.

Install Mechanism

No install spec (instruction-only + bundled Python scripts). Nothing is downloaded or executed at install time; risk is limited to running included Python scripts.

Credentials

The code requires a single API key (MESHY_API_KEY) and optionally MESHY_BASE_URL, which is appropriate for a REST API client. The registry metadata failing to declare this required env var is a discrepancy that should be corrected before trusting the metadata alone.

Persistence & Privilege

The skill does not request permanent presence (always=false) and does not modify other skills or system-wide settings. It can be invoked autonomously by the agent (platform default), which is expected for a callable skill.

Assessment

This skill appears to do exactly what it claims: it needs your Meshy API key, creates async jobs, polls for completion, and downloads images/OBJ files. Before installing or running: (1) ensure the registry metadata is corrected to list MESHY_API_KEY so you know what credentials are required; (2) only provide an API key you trust Meshy with (use limited-scope keys if available); (3) be aware downloads come from URLs returned by the service — avoid running untrusted binaries and inspect downloaded content before executing anything; (4) if you’ll run the scripts locally, run them in an isolated environment (container or VM) if you have concerns about third-party content. If you need higher assurance, request that the publisher add the required env var to the registry metadata and confirm the package's provenance/homepage.

Generate Meshy assets via API and save outputs locally.

Setup

• Add env var: MESHY_API_KEY=msy-...
• Optional: MESHY_BASE_URL (defaults to https://api.meshy.ai)

Text → 2D (Text to Image)

Use scripts/text_to_image.py.

python3 skills/public/meshy-ai/scripts/text_to_image.py \
  --prompt "a cute robot mascot, flat vector style" \
  --out-dir ./meshy-out

• Downloads one or more images (if multi-view) into ./meshy-out/text-to-image_<taskId>_<slug>/.

Image → 3D (always save OBJ)

Use scripts/image_to_3d_obj.py.

Local image

python3 skills/public/meshy-ai/scripts/image_to_3d_obj.py \
  --image ./input.png \
  --out-dir ./meshy-out

Public URL

python3 skills/public/meshy-ai/scripts/image_to_3d_obj.py \
  --image-url "https://.../input.png" \
  --out-dir ./meshy-out

• Always downloads model.obj (and model.mtl if provided by Meshy) into ./meshy-out/image-to-3d_<taskId>_<slug>/.

Notes

• Meshy tasks are async: create → poll until status=SUCCEEDED → download URLs.
• API reference for this skill: references/api-notes.md.