gameobject-modify
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation recommends installing the
unity-mcp-clipackage globally usingnpm install -g unity-mcp-clior executing it vianpxto facilitate GameObject modifications. - [COMMAND_EXECUTION]: The skill uses the
unity-mcp-clitool to execute thegameobject-modifycommand. This is the primary function of the skill and involves passing JSON-formatted project data to the CLI tool. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input through the
gameObjectRefsandgameObjectDiffsparameters, creating a potential surface for indirect prompt injection if the project data contains malicious instructions that influence the agent's interpretation of the project state. - Ingestion points: Input data is ingested through the
gameObjectRefsandgameObjectDiffsfields defined in theSKILL.mdinput schema. - Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded content within the GameObject data.
- Capability inventory: The skill utilizes
unity-mcp-clito perform read and write operations on Unity scene and prefab data. - Sanitization: No explicit sanitization or validation of the content of GameObject fields (such as names or string values) is specified in the schema.
Audit Metadata