unity-explorer-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local development commands such as
npm install,npm run start, andlsofto manage the scene preview environment and local dev server. - [EXTERNAL_DOWNLOADS]: Fetches 3D models and assets from reputable community sources like kenney.nl and itch.io. It also uses
npxto install additional topic skills from the officialdecentraland/sdk-skillspackage. - [DYNAMIC_EXECUTION]: Utilizes a bundled shell script (
scripts/screenshot.sh) containing an embedded Python script. This script is used locally to parse JSON-RPC responses and decode Base64 image data from the local Explorer server to save screenshots to disk. - [INDIRECT_PROMPT_INJECTION]: The skill ingests runtime logs and entity state from the Explorer environment. While this represents a surface for indirect instructions, it is a standard requirement for its primary purpose of debugging the developer's own scene code.
- [PRIVILEGE_ESCALATION]: Noted use of
chmodis limited to the skill's own scripts, and there are no instances ofsudoor unauthorized system-level modifications.
Audit Metadata