跳到主要内容
知仓学习社ZHICANG

game-asset-generator

Deterministic palette/matrix pixel art (not AI). Use for procedural tile art, color-quantized output, matrix sprites.

读凭据执行命令联网写文件读文件严重 16 · 高危 12notque/vexjoy-agent

它会碰到什么

扫了多少9 个文本文件,72 KB
它会碰到什么读凭据执行命令联网写文件读文件
命中总数68 处
命中统计严重 16 · 高 12 · 中 16 · 低 3
逐条看命中(28 条严重或高危)
  • 严重 references/asset-sources.md:17cred-paths
    Get token: sketchfab.com/settings/password (API token section). Add to `~/.env` as `SKETCHFAB_TOKEN`.
  • 严重 references/asset-sources.md:148cred-paths
    Get key: poly.pizza (create account, find API key in settings). Add to `~/.env` as `POLY_PIZZA_API_KEY`.
  • 严重 references/fal-ai-image.md:3cred-paths
    fal.ai provides queue-based image generation via 8 model endpoints. Requires `FAL_KEY` in `~/.env`. Auth header format is `Key $FAL_KEY` — not Bearer.
  • 严重 references/fal-ai-image.md:17cred-paths
    Get `FAL_KEY` at fal.ai. Add to `~/.env`.
  • 严重 references/meshyai.md:5cred-paths
    All requests require `MESHY_API_KEY` from `~/.env`. Assets are retained for **3 days only** — download GLB files immediately after generation completes.
  • 严重 references/meshyai.md:227cred-paths
    | 401 Unauthorized | Invalid or missing `MESHY_API_KEY` | Check `~/.env`, regenerate at app.meshy.ai |
  • 严重 references/worldlabs.md:21cred-paths
    Get `WLT_API_KEY` from platform.worldlabs.ai. Add to `~/.env`.
  • 严重 scripts/fal_queue_image_run.py:8cred-paths
    Requires: FAL_KEY in env or ~/.env
  • 严重 scripts/fal_queue_image_run.py:39cred-paths
    env_path = Path.home() / ".env"
  • 严重 scripts/fal_queue_image_run.py:59cred-paths
    print("Error: FAL_KEY not found in env or ~/.env", file=sys.stderr)
  • 严重 scripts/meshy-generate.mjs:12cred-paths
    * Requires: MESHY_API_KEY in env or ~/.env
  • 严重 scripts/meshy-generate.mjs:28cred-paths
    const envPath = join(homedir(), '.env');
  • 严重 scripts/meshy-generate.mjs:50cred-paths
    console.error('Error: MESHY_API_KEY not found in env or ~/.env');
  • 严重 SKILL.md:81cred-paths
    grep -E "MESHY_API_KEY|WLT_API_KEY|FAL_KEY" ~/.env 2>/dev/null
  • 严重 SKILL.md:191cred-paths
    1. Verify `MESHY_API_KEY` is set in `~/.env` and the value is current
  • 严重 SKILL.md:206cred-paths
    Solution: Confirm `FAL_KEY` is in `~/.env`. Authorization header must be `Key <your-key>` -- not `Bearer <your-key>`.
  • scripts/fal_queue_image_run.py:52cred-envread
    os.environ[key] = val
  • scripts/fal_queue_image_run.py:57cred-envread
    FAL_KEY = os.environ.get("FAL_KEY")
  • scripts/meshy-generate.mjs:44cred-envread
    const API_KEY = process.env.MESHY_API_KEY;
  • scripts/optimize-glb.mjs:18exec-spawn
    import { execSync } from 'child_process';
  • scripts/optimize-glb.mjs:18exec-spawn
    import { execSync } from 'child_process';
  • scripts/optimize-glb.mjs:30exec-spawn
    execSync('gltf-transform --version', { stdio: 'pipe' });
  • scripts/optimize-glb.mjs:50exec-spawn
    execSync(`gltf-transform dedup "${inputPath}" "${tmpPath}"`, { stdio: 'inherit' });
  • scripts/optimize-glb.mjs:51exec-spawn
    execSync(`gltf-transform prune "${tmpPath}" "${tmpPath}"`, { stdio: 'inherit' });
  • scripts/optimize-glb.mjs:55exec-spawn
    execSync(`gltf-transform resize "${tmpPath}" "${tmpPath}" --width 1024 --height 1024`, {
  • scripts/optimize-glb.mjs:62exec-spawn
    execSync(`gltf-transform webp "${tmpPath}" "${tmpPath}"`, { stdio: 'inherit' });
  • scripts/optimize-glb.mjs:70exec-spawn
    execSync(`gltf-transform meshopt "${tmpPath}" "${outputPath}"`, { stdio: 'inherit' });
  • scripts/optimize-glb.mjs:73exec-spawn
    try { execSync(`rm -f "${tmpPath}"`); } catch {}

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Game Asset Generator Skill

Overview

This skill generates game-ready assets (3D models, Gaussian Splat environments, 2D sprites, images/textures) using AI APIs and free asset sources. It follows a three-phase workflow: DETECT the asset type -> GENERATE via the appropriate API or source -> INTEGRATE into the game. Only the relevant reference is loaded per task -- do not load all references upfront.

Scope: Use for AI-generated 3D models, world environments, pixel art sprites, concept art, textures, and sourcing free pre-built assets. Keep game engine scripting, physics, game loop logic, and shader authoring in threejs-builder after asset generation.


Phase 1: DETECT

Goal: Identify the asset type from the request and load the single corresponding reference.

Step 1: Classify the request

| Signal in request | Asset Type | Reference to load |

|-------------------|-----------|-------------------|

| "3D model", "character model", "generate model", GLB, mesh, rig, animate, humanoid | 3D Model | references/meshyai.md |

| "environment", "world", "scene background", "gaussian splat", "splat", volumetric | Environment | references/worldlabs.md |

| "sprite", "pixel art", "2D character", "tile", "tileset", canvas sprite | 2D Sprite | references/pixel-art-sprites.md |

| "image", "texture", "concept art", "icon", "generate image", chroma key | Image / Texture | references/fal-ai-image.md |

| No API key available, "free asset", "find model", "download asset", generation failed | Existing Assets | references/asset-sources.md |

If the request is ambiguous between 3D Model and Image, ask: "Do you need a 3D mesh (GLB file for a Three.js scene) or a 2D image/texture?"

Step 2: Check API key availability

Before calling any paid API, verify the required key exists:

grep -E "MESHY_API_KEY|WLT_API_KEY|FAL_KEY" ~/.env 2>/dev/null

If the required key is missing, the fallback chain applies -- load references/asset-sources.md alongside the primary reference.

Fallback chain: Meshy API -> Sketchfab search -> Poly Haven -> Poly.pizza -> BoxGeometry placeholder. All sources output GLB into the same path so game loading code does not change.

Gate: Asset type identified, relevant reference loaded. Proceed to Phase 2 only when gate passes.


Phase 2: GENERATE

Goal: Call the API or source to produce the asset. Follow the loaded reference exactly -- it is the authoritative guide for its API.

Core constraints (all asset types):

  • Download immediately -- Meshy retains assets only 3 days; World Labs SPZ files expire similarly. Never assume a URL will be valid tomorrow.
  • Output to a stable path -- write assets to public/assets/ or an equivalent game-accessible directory so integration code does not need path changes per asset.
  • Save the .meta.json sidecar -- every generated asset gets a .meta.json recording the prompt, model, generation timestamp, and asset ID. Required for regeneration and auditing.
  • Validate the output file -- after download, confirm file size > 0 and extension matches expected type (GLB, SPZ, PNG, etc.) before proceeding.

Per-type generation summary (read the reference for full API details):

3D Model (Meshy): Two-step pipeline -- preview (fast, low quality, confirms prompt works) -> refine (full quality). Auto-rig only for humanoids meeting all criteria: bipedal, textured, clearly defined limbs. Animate rigged models with walk/run/idle presets. Post-process with scripts/optimize-glb.mjs for 80-95% size reduction before integration.

Environment (World Labs): Upload reference image (preferred over text-only) -> poll 3-8 minutes -> download SPZ + GLB collider + panorama JPG. Y-axis flip (rotation.x = Math.PI) required after loading into Three.js scene.

2D Sprite (code-only): Canvas-based generation -- no API call. Load references/pixel-art-sprites.md and generate sprites from the palette and matrix system defined there. Works without any API key.

Image / Texture (fal.ai): Queue-based API -- submit job -> poll for result. Choose model endpoint based on need (GPT Image 1.5 for transparency, Nano Banana 2 for speed). Use #00FF00 chroma-key background when the asset needs transparency extraction.

Gate: Asset file downloaded and validated (size > 0, correct extension). .meta.json saved. Proceed to Phase 3 only when gate passes.


Phase 3: INTEGRATE

Goal: Load the generated asset into the game scene correctly.

Core constraint: Use SkeletonUtils.clone() -- never .clone() -- for animated models. Regular .clone() breaks skeleton bindings and leaves the model in a permanent T-pose. This is the single most common integration failure with rigged GLBs.

import { SkeletonUtils } from 'three/addons/utils/SkeletonUtils.js';

// Load once, clone for each instance
loader.load('/assets/character.glb', (gltf) => {
  const instance = SkeletonUtils.clone(gltf.scene);
  scene.add(instance);
});

GLB loading (Three.js):

import { GLTFLoader } from 'three/addons/loaders/GLTFLoader.js';
import { DRACOLoader } from 'three/addons/loaders/DRACOLoader.js';

const dracoLoader = new DRACOLoader();
dracoLoader.setDecoderPath('https://www.gstatic.com/draco/versioned/decoders/1.5.6/');

const loader = new GLTFLoader();
loader.setDRACOLoader(dracoLoader); // Required for Draco-compressed GLBs from Meshy optimizer
loader.load('/assets/model.glb', (gltf) => {
  const model = gltf.scene;
  const box = new THREE.Box3().setFromObject(model);
  const center = box.getCenter(new THREE.Vector3());
  model.position.sub(center);
  scene.add(model);
});

Gaussian Splat (World Labs) -- see references/worldlabs.md for the @sparkjsdev/spark SplatMesh integration. The Y-axis flip and raycast direction inversion are required, not optional.

Animation playback:

const mixer = new THREE.AnimationMixer(model);
const action = mixer.clipAction(gltf.animations[0]); // walk/run/idle from Meshy
action.play();

// In animation loop:
mixer.update(deltaTime);

Gate: Asset visible in scene. No console errors. Animations play if applicable.


Reference Loading Table

| Signal | Load These Files | Why |

|---|---|---|

| "3D model", "character model", "generate model", GLB, mesh, rig, animate, humanoid | meshyai.md | 3D Model |

| "environment", "world", "scene background", "gaussian splat", "splat", volumetric | worldlabs.md | Environment |

| "sprite", "pixel art", "2D character", "tile", "tileset", canvas sprite | pixel-art-sprites.md | 2D Sprite |

| "image", "texture", "concept art", "icon", "generate image", chroma key | fal-ai-image.md | Image / Texture |

| No API key available, "free asset", "find model", "download asset", generation failed | asset-sources.md | Existing Assets |

| references/meshyai.md | meshyai.md | 3D model generation request |

| references/worldlabs.md | worldlabs.md | Environment / Gaussian Splat request |

| references/fal-ai-image.md | fal-ai-image.md | Image, texture, or concept art request |

| references/asset-sources.md | asset-sources.md | No API key, fallback chain, or "find free asset" |

| references/pixel-art-sprites.md | pixel-art-sprites.md | 2D sprite or pixel art request |

Error Handling

Error: "GLB loads but model is in T-pose"

Cause: Used .clone() instead of SkeletonUtils.clone() on a rigged model.

Solution: Replace gltf.scene.clone() with SkeletonUtils.clone(gltf.scene). Import from three/addons/utils/SkeletonUtils.js.

Error: "Meshy task stuck in PENDING"

Cause: API key invalid, quota exceeded, or Meshy service issue.

Solution:

  1. Verify MESHY_API_KEY is set in ~/.env and the value is current
  2. Check quota at app.meshy.ai
  3. If quota exhausted, fall through to references/asset-sources.md fallback chain
  4. Use status mode: node scripts/meshy-generate.mjs status <task_id>

Error: "Downloaded GLB is 0 bytes or corrupt"

Cause: URL expired (Meshy 3-day limit) or network error during download.

Solution: Regenerate -- do not attempt to repair a corrupt GLB. Resubmit using the prompt saved in .meta.json.

Error: "Gaussian Splat renders but objects fall through floor"

Cause: Raycast direction inverted after Y-axis flip on the SplatMesh.

Solution: Load references/worldlabs.md -- the fix is in the raycast inversion section.

Error: "fal.ai request returns 401"

Cause: FAL_KEY missing or incorrectly formatted. fal.ai uses Key $FAL_KEY format (not Bearer).

Solution: Confirm FAL_KEY is in ~/.env. Authorization header must be Key <your-key> -- not Bearer <your-key>.

Error: "gltf-transform command not found"

Cause: @gltf-transform/cli not installed globally.

Solution: npm install -g @gltf-transform/cli


References

| Reference | When to load | Content |

|-----------|-------------|---------|

| references/meshyai.md | 3D model generation request | Meshy API: text-to-3D, image-to-3D, rig, animate, status polling, optimize-glb |

| references/worldlabs.md | Environment / Gaussian Splat request | World Labs Marble API: SPZ generation, SplatMesh renderer, Y-flip gotcha |

| references/fal-ai-image.md | Image, texture, or concept art request | fal.ai: 8 model endpoints, queue API, cost tracking, chroma-key |

| references/asset-sources.md | No API key, fallback chain, or "find free asset" | Sketchfab, Poly Haven, Poly.pizza search and download workflows |

| references/pixel-art-sprites.md | 2D sprite or pixel art request | Canvas sprite matrices, palette system, animation frames (no API needed) |

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 419
本站分层T2
该仓技能数122
原文件路径skills/game/game-asset-generator/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 122 个技能