scene-set-active

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing the unity-mcp-cli package from the npm registry to enable its functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines an interface that ingests project-specific data which could be manipulated if an attacker can influence the project files the agent reads.
  • Ingestion points: The sceneRef object in SKILL.md accepts assetPath and assetGuid strings.
  • Boundary markers: The schema does not specify any delimiters or instructions for the agent to ignore potentially malicious instructions embedded in the asset metadata.
  • Capability inventory: The skill uses unity-mcp-cli to perform state changes (setting active scenes) within a Unity development environment.
  • Sanitization: No sanitization or validation logic for the input strings is defined within the skill's instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 04:31 PM