gameobject-component-destroy
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions suggest installing the 'unity-mcp-cli' package via npm or running it through npx. This package is an external dependency from a source not included in the trusted vendor list.\n- [COMMAND_EXECUTION]: The skill executes shell commands using 'unity-mcp-cli' to interact with the Unity editor, passing user-controlled JSON data to the command-line interface.\n- [INDIRECT_PROMPT_INJECTION]: The skill allows for the destruction of components based on object references, which creates a vulnerability surface if the agent processes malicious data from an untrusted source.\n
- Ingestion points: The 'gameObjectRef' and 'destroyComponentRefs' input parameters defined in 'SKILL.md'.\n
- Boundary markers: No delimiters or instructions are provided to the agent to ignore potentially malicious embedded content within the Unity references.\n
- Capability inventory: Destructive component removal in a development environment via a CLI tool.\n
- Sanitization: No input validation, escaping, or filtering of the component references is specified in the skill logic.
Audit Metadata