package-list
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
unity-mcp-clicommand to retrieve package data from a Unity project. This is the primary intended function of the skill and is scoped to package management. - [EXTERNAL_DOWNLOADS]: The documentation references the installation of
unity-mcp-clivia the npm registry, which is a well-known package management service. - [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided strings for filtering packages, creating a surface where untrusted data could be processed by the agent.
- Ingestion points:
sourceFilterandnameFilterparameters inSKILL.md. - Boundary markers: None identified.
- Capability inventory: Execution of
unity-mcp-clivia the shell. - Sanitization: None specified; the skill relies on the underlying CLI tool to handle input safely.
Audit Metadata