assets-move
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions mention installing the
unity-mcp-clipackage via npm (npm install -g unity-mcp-cli). This is a standard installation procedure for the command-line tool used by the skill. - [COMMAND_EXECUTION]: The skill functions by executing the
unity-mcp-clicommand with user-provided arguments to move assets within a Unity project. - [INDIRECT_PROMPT_INJECTION]: The skill processes array inputs for file paths (
sourcePaths,destinationPaths). This represents a vulnerability surface if the agent processes untrusted data to determine which files to move. - Ingestion points: Input fields
sourcePathsanddestinationPathsdefined inSKILL.md. - Boundary markers: None present in the skill instructions.
- Capability inventory: File system movement/renaming via
unity-mcp-cli. - Sanitization: No sanitization logic is specified in the prompt instructions; safety relies on the underlying CLI tool's implementation.
Audit Metadata