assets-modify

Pass

Audited by Gen Agent Trust Hub on Apr 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the unity-mcp-cli tool to modify asset files. This involves executing a command-line interface with user-provided parameters.- [EXTERNAL_DOWNLOADS]: The documentation mentions installing the unity-mcp-cli package via the npm registry. This is a legitimate dependency for the tool's intended functionality and is provided by the author.- [PROMPT_INJECTION]: The skill accepts complex JSON input to override asset contents, creating a surface for potential indirect prompt injection.
  • Ingestion points: External data is accepted through the assetRef and content fields in the input schema.
  • Boundary markers: The instructions do not specify any delimiters to isolate the content from the command execution logic.
  • Capability inventory: The tool has the capability to perform file system modifications via unity-mcp-cli.
  • Sanitization: The skill documentation does not describe any validation or sanitization logic for the data provided in the asset content.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 25, 2026, 08:03 PM