The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill supports adding packages from arbitrary Git URLs or local paths, which inherently triggers the execution of scripts or code contained within those packages during Unity's resolution and domain reload processes.
[COMMAND_EXECUTION]: The skill uses the unity-mcp-cli command-line utility to modify project files and trigger package management operations, involving shell-level command execution.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to being directed by untrusted inputs to install malicious packages.
Ingestion points: The packageId argument in the package-add tool accepts arbitrary package names, URLs, or paths.
Boundary markers: No explicit delimiters or instructions are provided to the agent to prevent the interpretation of instructions embedded within the package ID or surrounding context.
Capability inventory: The tool has the ability to modify the project's manifest.json and trigger the execution of code through package resolution.
Sanitization: The tool does not implement validation or sanitization of the package source before execution.
[EXTERNAL_DOWNLOADS]: The documentation references the installation of the unity-mcp-cli tool from the npm registry, which is a standard procedure for this utility.

package-add