The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python's subprocess module to open generated 3D models in locally installed slicer applications such as OrcaSlicer, Bambu Studio, and PrusaSlicer. These calls use a list-based argument structure that avoids shell invocation, minimizing injection risks.
[EXTERNAL_DOWNLOADS]: The skill fetches 3D model files (3MF, OBJ, GLB) and thumbnails from the official Meshy API domain (api.meshy.ai).
[DATA_EXFILTRATION]: User prompts, images, and the Meshy API key are transmitted to the vendor's API for generation and processing. The skill avoids scanning home directories or shell profiles for credentials, opting for environment variables or a local .env file.
[INDIRECT_PROMPT_INJECTION]: The skill ingests JSON responses from the Meshy API and parses OBJ file contents. While this provides a theoretical attack surface for indirect prompt injection, the risk is negligible as the processing is restricted to technical coordinate transformations and structured data parsing.
Ingestion points: API task results (JSON) and OBJ model file vertex data.
Boundary markers: None explicitly used in the construction of prompts sent to the API, though data is passed via structured JSON payloads.
Capability inventory: File system access to meshy_output/, network access to api.meshy.ai, and local application execution via subprocess.
Sanitization: The skill performs type-casting to floats for geometric data and uses standard JSON parsing libraries for API responses.

meshy-3d-printing