unity-game-dev
Warn
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides C# snippets in
adapters/coplay-unity-mcp/scripts/designed to be executed via a community MCP server. Theexecute_codetool compiles and runs this code within the Unity Editor's process, which the documentation notes is not a security sandbox. - [COMMAND_EXECUTION]: The skill enables arbitrary code execution within the Unity Editor through the
execute_codediagnostic tool. This provides the agent with deep access to the project's environment, including reflection and the ability to read script source code. - [PROMPT_INJECTION]: The skill instructions and diagnostic scripts (e.g.,
check-input-system.cs) direct the agent to read and analyze script source code and other project files. This behavior creates a surface for indirect prompt injection, as malicious instructions embedded in project assets could influence the agent's actions. - [EXTERNAL_DOWNLOADS]: The documentation in
docs/research-sources.mdincludes commands to download various external repositories from GitHub for research and maintenance purposes. While many sources are from well-known organizations, this practice involves fetching a large volume of external code into the local environment.
Audit Metadata