meshy-3d-generation — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited meshy-3d-generation (Agent Skill) and scored it 83/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 4 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 4 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use Meshy CLI 0.4.3 to turn the user's request into a delivered asset. Completion means saving the requested files in the requested location, inspecting an available preview, and finishing any project integration the user requested. Login or task submission alone is not completion. Choose the shortest suitable pipeline and reuse existing assets for follow-ups.
| Need | Reference |
|---|---|
| CLI runner, credentials, or output location | Setup |
| Generation, texturing, rigging, animation, or conversion | Pipelines |
| Cost, waiting, preview, delivery, or finding a previous model | Delivery |
| Failed or uncertain operation | Troubleshooting |
Read the relevant section when needed; recipes are examples to adapt to the requested result, not a requirement to execute every stage. An untextured model skips texture generation; an existing GLB needs no extra format conversion. Use command help when parameters are uncertain.
Resolve the runner automatically: use compatible meshy, otherwise npm exec --yes [email protected] -- meshy …. Reuse a verified session. If login is needed, follow Setup and run auth login --device in a persistent tool session. Show its verification URL and user code in commentary/progress, not a final answer. Await that same session in this turn until it exits, verify auth status, then continue the original request. A background process cannot resume a finished turn; do not require a "done" chat message. Browser approval stays with the user; credentials never belong in chat.
limit, and a local model must be GLB or glTF (rigging and multicolor: GLB); use the supported URL input route for anything else.
--output-schema v1 --format json --no-update-check for business commands; auth hasits own JSON shape. Resolve WORKSPACE from the user's output path and pass it to writes.
create --async, retain the owning resource and ID, then wait on thattask. Keep the agent turn active while awaiting a running command. Follow Troubleshooting on timeout or unknown submission; these do not authorize another paid create.
or reruns before spending; Delivery specifies estimates and balance checks.
Download only needed assets. Inspect and show a preview when available; a missing preview must not prevent delivery or be described as inspected. Delivery covers earlier-stage preview lookup, actual charges, and existing-project integration. Report the result and any concrete limitation; a rendered image does not establish topology quality or provide a 3D viewer.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.