assets-shader-get-data
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local file system which may contain malicious instructions.
- Ingestion points: The skill reads shader files from the project's
Assets/andPackages/folders via theassetRefinput parameter. - Boundary markers: There are no explicit boundary markers or instructions to the agent to ignore embedded content when processing the returned source code.
- Capability inventory: The tool can retrieve and return the full
SourceCodeof shader passes, which is then provided to the agent's context. - Sanitization: The skill does not mention any sanitization, filtering, or validation of the shader source code content before it is processed by the agent.
- [EXTERNAL_DOWNLOADS]: The skill documentation recommends that the user install the
unity-mcp-clipackage from the NPM registry to function. - [COMMAND_EXECUTION]: The skill operates by executing shell commands via the
unity-mcp-clitool to interact with the Unity project environment.
Audit Metadata