tripo3d

Tripo3D AI 3D model generation. Use when generating 3D models from text prompts or images via the Tripo3D API. Supports Text-to-3D, Image-to-3D, Multiview-to...

The SKILL.md appears to implement a legitimate Tripo3D API client, but the registry metadata does not declare the TRIPO3D_API_KEY that the instructions require — this mismatch is the main concern. Before installing: (1) confirm the skill owner and whether the registry metadata will be corrected to list TRIPO3D_API_KEY; (2) only provide an API key you can revoke (create a scoped/test key if the platform allows); (3) be aware the instructions favor PowerShell/.NET and a local proxy (127.0.0.1:7897) — routing traffic through a proxy can expose requests to interception, so avoid enabling unknown system proxies; (4) test on an isolated account/environment first to confirm behavior; (5) ask the maintainer why the metadata omits required env vars and why Python/aiohttp is discouraged. These checks will reduce risk and clarify whether the inconsistencies are just sloppy packaging or something more suspicious.

Type: OpenClaw Skill Name: tripo3d Version: 1.0.1 The skill provides instructions for interacting with the Tripo3D API but contains highly specific directives in `SKILL.md` to use Windows PowerShell and a hardcoded local proxy (127.0.0.1:7897) for all API calls and file downloads. While these are presented as workarounds for Python proxy limitations, the use of PowerShell and the redirection of traffic through a specific local port increases the attack surface and could potentially be used to intercept credentials via the `-ProxyUseDefaultCredentials` flag. No clear evidence of intentional data exfiltration or malicious backdoors was found, but the non-standard execution path is risky.