object-get-data
Warn
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
unity-mcp-clipackage globally vianpmor execute it usingnpx. This involves downloading code from an external public registry that is not associated with a known trusted service. - [COMMAND_EXECUTION]: The skill's primary function is implemented by executing shell commands through the
unity-mcp-clitool. - [INDIRECT_PROMPT_INJECTION]: The skill processes and returns serialized data from Unity objects (
UnityEngine.Object), which can contain data from untrusted sources within a Unity project. - Ingestion points: Data is ingested from Unity components, assets, and GameObjects identified via the
objectRefparameter inSKILL.md. - Boundary markers: No boundary markers or instructions are provided to the agent to distinguish between data and potential commands within the serialized output.
- Capability inventory: The skill possesses the capability to execute shell commands via the CLI tool and read from the Unity runtime environment.
- Sanitization: There is no evidence of sanitization or validation performed on the fields and properties retrieved from the Unity objects before they are returned to the agent context.
Audit Metadata