gameobject-component-add
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with the Unity editor by executing the
unity-mcp-clicommand-line tool. This behavior is consistent with the skill's stated purpose of managing Unity GameObjects. - [EXTERNAL_DOWNLOADS]: The documentation suggests installing the
unity-mcp-clipackage usingnpmornpx. This is a standard method for providing the necessary runtime environment for the skill's tools. - [INDIRECT_PROMPT_INJECTION]: The skill has an injection surface where untrusted data is passed to a CLI tool. Evidence Chain: (1) Ingestion points: componentNames and gameObjectRef in SKILL.md; (2) Boundary markers: None; (3) Capability inventory: Subprocess call to unity-mcp-cli; (4) Sanitization: None visible in the skill instructions.
Audit Metadata