The Agent Skills Directory

[DYNAMIC_EXECUTION]: The component_invoke_method and component_invoke_method_batch functions provide an interface for calling arbitrary instance or static methods on Unity components via reflection. This is a high-capability feature that allows for significant runtime control over the Unity environment. The documentation explicitly labels this as "high risk" and notes that it is restricted to specific operating modes to ensure user oversight.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture creates an attack surface for indirect prompt injection because it consumes untrusted data (like method arguments and property values) and performs high-impact operations. If an agent processes malicious data (e.g., from a file or external source) and uses it as input for these skills, it could perform unintended actions.
Ingestion points: Parameters such as methodName, arguments, propertyName, and value across multiple skills (e.g., in reference/component_invoke_method.md and reference/component_set_property.md).
Boundary markers: There are no explicit instructions in the skill files for the agent to use delimiters or ignore instructions found within the processed data.
Capability inventory: The skill allows for broad state modification and arbitrary code execution within the Unity assembly via reflection.
Sanitization: The module performs basic type and enum validation, but lacks a restrictive allowlist for methods or properties, relying instead on platform-level operating mode restrictions.

unity-component