scene-save
Warn
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The instructions recommend installing an external Node.js package,
unity-mcp-cli, either globally usingnpm install -gor vianpx. This package represents an external dependency required for the skill to function.\n- [COMMAND_EXECUTION]: The skill's primary operation involves executing theunity-mcp-clitool through a shell environment with user-supplied arguments.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external inputs such asopenedSceneNameandpathand passes them as arguments to a CLI tool. This creates a surface for indirect prompt injection if the inputs are not properly sanitized or if the underlying tool has vulnerabilities related to input handling.\n - Ingestion points: The
openedSceneNameandpathparameters in the input JSON schema.\n - Boundary markers: None are defined to separate user input from the command structure.\n
- Capability inventory: The skill can trigger filesystem operations (saving scenes) by executing the
unity-mcp-clitool.\n - Sanitization: No sanitization or validation logic is specified in the skill's instructions.
Audit Metadata