tripo3d

Tripo3D AI 3D model generation. Use when generating 3D models from text prompts or images via the Tripo3D API. Supports Text-to-3D, Image-to-3D, Multiview-to...

Security Scan

The skill's runtime instructions look like a normal Tripo3D API integration, but the package metadata omits required credentials and the SKILL.md contains Windows/PowerShell-specific proxy instructions and contradictory polling guidance — these inconsistencies merit caution.

Purpose & Capability

The SKILL.md clearly requires a TRIPO3D_API_KEY and describes calling the Tripo3D API (endpoints, uploads, downloads), which is coherent with the skill's name and description. However, the registry metadata lists no required env vars or primary credential — that is inconsistent and misleading for users who expect credential requirements to be declared. The SKILL.md also assumes PowerShell/.NET for downloads (Windows-specific) but the skill declares no OS or binary requirements.

Instruction Scope

Instructions focus on creating tasks, uploading images, polling status, and downloading models — all within the stated purpose. Concerns: (1) the doc strongly pushes PowerShell/.NET WebClient and a particular local proxy (Clash Verge on port 7897), which is operational guidance that could route traffic through a local proxy; (2) polling guidance is inconsistent (it says poll every 5–10s, but also says 'Never block with sleep' and 'poll only when user asks'); (3) SKILL.md requires access to an API key (not declared in metadata). The instructions do not ask the agent to read unrelated files or other credentials.

Install Mechanism

No install spec and no code files — instruction-only skill. This minimizes on-disk footprint and is the lowest-risk install pattern.

Credentials

The runtime docs require TRIPO3D_API_KEY (appropriate for an API client), but the registry metadata did not declare any required env vars or a primary credential. That discrepancy is a red flag: users may not realize they must supply an API key. No other credentials are requested, which is proportionate to the described functionality.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or persistent platform privileges. It is user-invocable and allows autonomous invocation (the platform default); that alone is expected and not a reason to flag.

What to consider before installing

The SKILL.md appears to implement a legitimate Tripo3D API client, but the registry metadata does not declare the TRIPO3D_API_KEY that the instructions require — this mismatch is the main concern. Before installing: (1) confirm the skill owner and whether the registry metadata will be corrected to list TRIPO3D_API_KEY; (2) only provide an API key you can revoke (create a scoped/test key if the platform allows); (3) be aware the instructions favor PowerShell/.NET and a local proxy (127.0.0.1:7897) — routing traffic through a proxy can expose requests to interception, so avoid enabling unknown system proxies; (4) test on an isolated account/environment first to confirm behavior; (5) ask the maintainer why the metadata omits required env vars and why Python/aiohttp is discouraged. These checks will reduce risk and clarify whether the inconsistencies are just sloppy packaging or something more suspicious.

Tripo3D AI 3D Generation Skill

Overview

Tripo3D is a leading AI 3D generation platform. This skill handles:

• Text → 3D: Natural language prompt to 3D model
• Image → 3D: Single image to 3D model (photo to 3D)
• Multiview → 3D: 4 images (front/left/back/right) to higher fidelity 3D
• Refine Model: Enhance an existing draft model
• Polling: Check generation status and retrieve results
• Download: GLB/FBX model files + preview images

Setup

Requires TRIPO3D_API_KEY environment variable.

Get your API key at: https://platform.tripo3d.ai

Proxy Configuration (Windows + Clash Verge)

Clash Verge (verge-mihomo) proxy port: 7897 — not 7890.

Use PowerShell for all API calls:

Invoke-RestMethod -Uri '...' -Proxy 'http://127.0.0.1:7897' -ProxyUseDefaultCredentials

For file downloads, use .NET WebClient:

$wc = New-Object System.Net.WebClient
$wc.Proxy = New-Object System.Net.WebProxy("http://127.0.0.1:7897")
$wc.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials
$wc.DownloadFile($url, $outPath)

Python SDK (aiohttp) does NOT respect system proxy — use PowerShell instead.

Base URL

https://api.tripo3d.ai/v2/openapi

All requests require header:

Authorization: Bearer <TRIPO3D_API_KEY>
Content-Type: application/json

Core Endpoints

Action	Method	Path
Create task	POST	/task
Check status	GET	/task/{task_id}
Upload image (STS)	POST	/upload/sts
Get balance	GET	/user/balance

Task Types

All generation uses POST /task with different type field values:

Type	Description
text_to_model	Text prompt → 3D model
image_to_model	Single image → 3D model
multiview_to_model	4 images (front/left/back/right) → 3D model
refine_model	Refine an existing draft model

---

Workflow 1: Text to 3D

Step 1 — Create task

POST /v2/openapi/task

{
  "type": "text_to_model",
  "prompt": "a fierce tiger with orange and black stripes"
}

Step 2 — Poll status

GET /v2/openapi/task/{task_id}

Poll every 5–10 seconds. Done when status === "success".

Step 3 — Download model From response: data.output.pbr_model.url

---

Workflow 2: Image to 3D

Step 1 — Upload image (STS)

POST /v2/openapi/upload/sts
Content-Type: multipart/form-data

Form field: file (JPEG/PNG/WEBP, max 10MB, min 256px)

Response:

{ "code": 0, "data": { "image_token": "uuid-xxx" } }

Step 2 — Create image-to-3D task

POST /v2/openapi/task

{
  "type": "image_to_model",
  "file": {
    "type": "jpg",
    "file_token": "<image_token>"
  }
}

Or use image URL directly (no upload needed):

{
  "type": "image_to_model",
  "file": {
    "type": "jpg",
    "url": "https://example.com/photo.jpg"
  }
}

Step 3 — Poll status (same as Text-to-3D)

Step 4 — Download model

---

Workflow 3: Multiview to 3D

Upload 4 images (front, left, back, right), then:

POST /v2/openapi/task

{
  "type": "multiview_to_model",
  "files": [
    { "type": "jpg", "file_token": "<front_token>" },
    { "type": "jpg", "file_token": "<left_token>" },
    { "type": "jpg", "file_token": "<back_token>" },
    { "type": "jpg", "file_token": "<right_token>" }
  ]
}

Front image is required; other 3 can be empty {}.

---

Workflow 4: Refine Model

POST /v2/openapi/task

{
  "type": "refine_model",
  "draft_model_task_id": "<task_id_of_draft>"
}

Note: Only works with model_version < v2.0-20240919 drafts.

---

Common Parameters

Parameter	Applies to	Description
model_version	all	Version: P1-20260311, Turbo-v1.0-20250506, v3.1-20260211, v3.0-20250812, v2.5-20250123 (default), v2.0-20240919, v1.4-20240625
texture	all	Enable texture, default true
pbr	all	Enable PBR, default true
texture_quality	all	"detailed" or "standard" (default)
face_limit	all	Limit polygon count (1000~20000)
quad	text/image	true → FBX output (not GLB)
compress	all	"geometry" for compressed output
auto_size	all	Scale to real-world meters
texture_alignment	image/multiview	"original_image" or "geometry"
model_seed	all	Integer, reproducible generation
texture_seed	all	Integer, reproducible texture
enable_image_autofix	image/multiview	Auto-enhance input image
generate_parts	text/image	Segmentation mode

P1-20260311 (Low-poly optimized)

Use for game assets, stylized/low-poly models. Only supports: model_version, model_seed, face_limit (48~20000), texture, pbr, texture_seed, texture_quality, auto_size, compress, export_uv.

---

Polling Logic

⚠️ Generation is asynchronous. Poll every 5–10 seconds.

Status values:

• queued → waiting in queue
• running → actively generating
• success → done, use output
• failed / banned / expired / cancelled → check error

Never block with sleep. Submit job, reply with task_id, poll only when user asks.

---

Download

Model URLs expire after ~5 minutes. Download immediately after success.

Use .NET WebClient (PowerShell):

$wc = New-Object System.Net.WebClient
$wc.Proxy = New-Object System.Net.WebProxy("http://127.0.0.1:7897")
$wc.Proxy.Credentials = [System.Net.CredentialCache]::DefaultCredentials
$wc.DownloadFile($modelUrl, $outPath)

Output files from data.output:

• pbr_model.url → GLB file (main model)
• generated_image.url → AI concept preview image
• rendered_image.url → Model rendering preview

---

Cost

Task	Credits
Text-to-3D	~20
Image-to-3D	~20
Multiview-to-3D	~20
Refine Model	~20

Check balance: GET /v2/openapi/user/balance

---

Error Handling

Code	Meaning
2010	Insufficient credit
2001	Task not found (wrong task_id or API key mismatch)
2002	Unsupported task type
2003	Empty input file
2004	Unsupported file type
429 2000	Rate limited — retry later

---

Windows PowerShell Upload Example

$headers = @{
  'Authorization' = 'Bearer <API_KEY>'
}
$filePath = "C:/path/to/image.jpg"
$response = Invoke-RestMethod -Uri 'https://api.tripo3d.ai/v2/openapi/upload/sts' `
  -Method POST `
  -Headers $headers `
  -ContentType 'multipart/form-data' `
  -Proxy 'http://127.0.0.1:7897' `
  -ProxyUseDefaultCredentials `
  -Body @{
    file = Get-Item $filePath
  }
$imageToken = $response.data.image_token