package-search
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation suggests installing the
unity-mcp-clipackage from the public NPM registry, which is an external and unverified source. - [REMOTE_CODE_EXECUTION]: The skill recommends using
npx unity-mcp-clito run the search tool, which downloads and executes code directly from the NPM registry at runtime. - [COMMAND_EXECUTION]: The skill relies on shell command execution via the
unity-mcp-clitool to interact with the Unity Package Manager and project files. - [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: The
queryinput field defined in the JSON schema in SKILL.md. 2. Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands within the search query. 3. Capability inventory: Shell command execution viaunity-mcp-cli(SKILL.md). 4. Sanitization: No sanitization or input validation for the search query is described or implemented in the skill.
Audit Metadata