Skills
Navigate
skills/idocohen560/claude-unity-game-studio/gameobject-duplicate/Gen Agent Trust Hub

gameobject-duplicate

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install an external, third-party package unity-mcp-cli from the NPM registry if it is not already present on the system.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data through the gameObjectRefs input, which includes GameObject names and paths.
  • Ingestion points: The gameObjectRefs field in the input schema of SKILL.md accepts arbitrary strings for name and path properties.
  • Boundary markers: None. There are no delimiters or instructions to ignore embedded commands within the ingested GameObject data.
  • Capability inventory: The skill executes shell commands via the unity-mcp-cli tool as shown in the 'How to Call' section of SKILL.md.
  • Sanitization: None. The instructions do not define any validation or escaping for the strings ingested from the Unity environment before they are passed to the CLI tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 04:32 PM