技能 image-to-3d
📦
image-to-3d
内容修订 r1 中风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
从图像创建 3D 资产
团队经常需要从现有图像快速生成 3D 资产，而不必配置模型提供商或本地运行时。此技能指导代理使用 Image Skill 命令进行托管的图像转 3D 生成、收据、恢复和反馈。
支持: Claude Codex Code(CC)
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "image-to-3d" from https://skillstore.io/skills/danielgwilson-image-to-3d.md and its manifest at https://skillstore.io/api/skills/danielgwilson-image-to-3d/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“image-to-3d”。 一张干净的陶瓷马克杯产品照片需要一个适合网页使用的 3D 预览。
预期结果:
一个托管 3D 资产链接、一份费用收据，以及关于杯柄形状、纹理质量和评审步骤的说明。
正在使用“image-to-3d”。 一张概念图像应转换为原型场景的快速占位网格。
预期结果:
一个带纹理的网格候选项，包含托管访问、生成详情，以及关于比例和清理需求的警告。
正在使用“image-to-3d”。 之前一次 image-to-3D 运行需要为另一个代理恢复。
预期结果:
一个已恢复的作业引用、资产 URL、收据摘要，以及任何可用的反馈或重试指导。
安全审计
中风险v4 • 2026/7/5 打开版本化报告
Most static backtick hits are Markdown formatting, but several examples do instruct agents to run unpinned npx commands, install skills, and change agent home state. The skill depends on a hosted API and paid media workflow, so users need explicit consent before uploads, spending, or service-returned command execution. No prompt injection language was found.
1
已扫描文件
79
分析行数
12
复核项
0
已忽略误报
已确认安全问题 (2)
中
Service-Returned Command Execution
Line 28 instructs agents to execute a command supplied in data.next_command by the hosted guide when a runnable flag is true. A compromised or unexpected service response could turn the workflow into agent-executed shell commands.
The instruction is explicit and tied to an external guide response. It includes a safety flag, so the risk depends on service behavior and user review.
中
Hosted Media Upload And Paid Processing
The skill centers on durable hosted media URLs, a wallet/payment loop, and a paid image-to-3D edit command. User images and job metadata may leave the workspace, and paid media generation can occur after approval.
The text directly references hosted media URLs, payments, media spend, and a max estimated USD command. It appears intended rather than malicious but has privacy and cost impact.
能力复核项 (12)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Ruby/shell backtick execution
Do not bring provider API keys, create provider accounts, run a local model server, or wire a separa
Line 28 directs the agent to run command strings returned by the hosted guide when a flag says they are runnable. That remote command handoff can cause unreviewed command execution, even with the stated gate.
中
Ruby/shell backtick execution
```bash
The range includes an npx -y image-skill@latest command that fetches and runs the latest npm package. This is external code execution and is unpinned.
中
Ruby/shell backtick execution
```bash
The range includes an npx -y image-skill@latest edit command that contacts a hosted service and can trigger paid media processing. It is legitimate for the skill but remains external command execution.
中
Ruby/shell backtick execution
```bash
The range includes npx skills add with a GitHub slug and a global Codex install flag. Running it fetches external tooling and modifies agent skill state.
中
Ruby/shell backtick execution
```bash
The range includes another npx skills add command for canonical skill installation. It executes external npm tooling and changes agent skill configuration.
中
Ruby/shell backtick execution
```bash
The range contains shell exports, mkdir, and npx skills add. These commands alter HOME and CODEX_HOME, then install a skill through external tooling.
中
Ruby/shell backtick execution
```
The broad flagged range includes an instruction on line 78 to run image-skill feedback create --json, which can send operational details to the hosted service. Confidence is moderate because the trigger is a Markdown fence.
中
Hidden file access
`$HOME/.agents`; `CODEX_HOME` keeps Codex profile state on the same writable
Line 59 states the adapter writes agent skill state under $HOME/.agents and references CODEX_HOME. That is hidden profile state and can affect persistence or configuration.
中
Hidden file access
export HOME="$PWD/.agent-home"
The command sets HOME to a hidden workspace path. Redirecting HOME changes where tools read and write credentials, cache data, and agent state.
中
Hidden file access
export CODEX_HOME="$HOME/.codex"
The command sets CODEX_HOME to a hidden .codex directory. This intentionally redirects Codex profile state, which is security relevant even if workspace scoped.
低
Hardcoded URL
canonical_api_url: https://api.image-skill.com
The canonical_api_url names the hosted API used by the runtime. This is a real external network dependency where user media and job data may be sent.
低
Hardcoded URL
- Hosted API: https://api.image-skill.com
The hosted API URL is the service endpoint for the skill workflow. It confirms reliance on an external service that can receive user images and job metadata.
风险因素
⚙️ 外部命令 (13)
🌐 网络访问 (8)
📁 文件系统访问 (3)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/danielgwilson-image-to-3d/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/danielgwilson-image-to-3d?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/danielgwilson-image-to-3d?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/danielgwilson-image-to-3d/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/danielgwilson-image-to-3d.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
danielgwilson. (2026). image-to-3d security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/danielgwilson-image-to-3d/audits/4BibTeX 引用
@techreport{danielgwilson-danielgwilson-image-to-3d-2026,
author = {danielgwilson},
title = {image-to-3d security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/danielgwilson-image-to-3d/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "image-to-3d security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "danielgwilson"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/danielgwilson-image-to-3d/audits/4"
identifiers:
- type: other
value: "skillstore:danielgwilson-image-to-3d:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
67
社区
83
规范符合性
你能构建什么
原型产品模型
将产品照片转换为托管的 GLB 风格资产，用于早期设计评审。
创建游戏占位资产
从概念图像生成快速带纹理网格候选项，用于原型场景。
准备电商预览
从已批准的目录图像创建可检查的 3D 资产，用于网页预览实验。
试试这些提示
从指南开始
Use the image-to-3d skill on this owned image. Start with the no-spend guide and ask before any paid generation.
创建网页预览资产
Convert this product image into a hosted GLB-style asset for web preview. Return the asset link, cost receipt, and inspection notes.
比较资产就绪度
Generate the 3D asset, inspect the result, and summarize geometry, texture, scale, and cleanup needs before I use it.
恢复或报告工作流缺口
Check whether Image Skill can recover this job or support this image-to-3D request. If it cannot, prepare feedback with the missing capability.
最佳实践
- 在使用托管服务前确认图像权利和上传许可。
- 从指南流程开始，并在付费生成前请求批准。
- 将资产链接、收据、模型名称和检查说明与项目一起保存。
避免
- 在未检查命令和花费字段的情况下运行服务返回的命令。
- 未经明确批准上传私有、受监管或第三方图像。
- 未经视觉检查就假定生成的网格已达到生产可用标准。
常见问题
这是否需要本地 3D 软件？
不需要。该技能使用托管的 Image Skill 运行时，而不是本地模型服务器。
重点输出格式是什么？
该技能侧重于托管的 3D 网格资产，例如 GLB 风格输出。
这个工作流会花钱吗？
可以。付费生成可能会使用额度，因此代理应在运行创建命令前询问。
它需要提供商 API 密钥吗？
不需要提供商密钥。托管运行时通过 Image Skill 处理提供商访问。
它对私有图像安全吗？
需要谨慎。图像可能会上传到托管服务，因此私有数据需要明确批准。
如果模型无法支持该请求会怎样？
该技能要求代理仅针对能力缺口使用备用方案，并提交关于缺失能力的反馈。
开发者详情
许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
7e9e368dc1a370f2040369ebcd0db06d90cb48e5
维护新鲜度
2026/7/18
使用量
2 次下载 · 0 次浏览
文件结构
📄 SKILL.md