assets-material-create
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests the installation of the
unity-mcp-clipackage from the npm registry without pinning a specific version, which is common for CLI tools but lacks dependency locking. - [INDIRECT_PROMPT_INJECTION]: The skill processes string inputs (
assetPathandshaderName) which are subsequently passed as arguments to a shell-executed CLI tool. 1. Ingestion points:assetPathandshaderNameproperties in the skill's input schema. 2. Boundary markers: Arguments are encapsulated within a JSON object passed to the CLI. 3. Capability inventory: The skill triggers the execution of theunity-mcp-clicommand via the shell. 4. Sanitization: No explicit validation or sanitization of the input strings is specified within the skill documentation.
Audit Metadata