script-update-or-create
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the unity-mcp-cli command-line utility to perform file system operations and trigger Unity editor updates.
- [EXTERNAL_DOWNLOADS]: The documentation suggests installing the unity-mcp-cli package from an external registry (NPM) if it is not already present in the environment.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts arbitrary string input for the script content and file path, which are written directly to the file system. 1. Ingestion points: filePath and content parameters in the input schema. 2. Boundary markers: No delimiters or ignore instructions are used to separate user data from script content. 3. Capability inventory: The skill can write files and trigger script compilation via AssetDatabase.Refresh(). 4. Sanitization: There is no evidence of validation or sanitization for the code content provided to the tool.
- [DYNAMIC_EXECUTION]: The tool facilitates the generation of C# source code that is automatically compiled by the Unity engine, representing a intended but inherently risky dynamic execution pattern.
Audit Metadata