gameobject-modify

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill documentation recommends installing the unity-mcp-cli package globally using npm install -g unity-mcp-cli or executing it via npx to facilitate GameObject modifications.
  • [COMMAND_EXECUTION]: The skill uses the unity-mcp-cli tool to execute the gameobject-modify command. This is the primary function of the skill and involves passing JSON-formatted project data to the CLI tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input through the gameObjectRefs and gameObjectDiffs parameters, creating a potential surface for indirect prompt injection if the project data contains malicious instructions that influence the agent's interpretation of the project state.
  • Ingestion points: Input data is ingested through the gameObjectRefs and gameObjectDiffs fields defined in the SKILL.md input schema.
  • Boundary markers: The skill does not explicitly define delimiters or instructions to ignore embedded content within the GameObject data.
  • Capability inventory: The skill utilizes unity-mcp-cli to perform read and write operations on Unity scene and prefab data.
  • Sanitization: No explicit sanitization or validation of the content of GameObject fields (such as names or string values) is specified in the schema.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 04:32 PM