The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes arbitrary string inputs for object names and search queries, which could serve as a vector for instructions embedded in untrusted data to influence agent behavior.
Ingestion points: Parameters such as name (in create_cube and create_sphere), objectName (in delete_object and various set_object_* skills), and nameContains (in find_objects_by_name).
Boundary markers: The skill definition contains no explicit delimiters or instructions to treat these string parameters as non-executable data or to ignore any instructions embedded within them.
Capability inventory: The skill provides significant control over a Unity environment, including creating, deleting, and modifying the transforms (position, rotation, scale) of scene objects.
Sanitization: No input validation, character filtering, or escaping mechanisms are described for the string-based parameters.

unity-sample