assets-prefab-create
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of an external Node.js package (
unity-mcp-cli) from the public NPM registry to function. - Evidence: The troubleshooting section suggests
npm install -g unity-mcp-clior usingnpx unity-mcp-cli. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
unity-mcp-clitool, passing user-provided parameters directly into the command line. - Evidence:
unity-mcp-cli run-tool assets-prefab-create --input '...'in SKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input to perform file system and Unity asset operations, creating a vulnerability surface if the ingested data contains malicious instructions.
- Ingestion points:
prefabAssetPath,gameObjectRef, andsourcePrefabAssetPath(SKILL.md). - Boundary markers: Absent; the instructions do not specify delimiters or warnings to ignore instructions embedded in the path or reference data.
- Capability inventory: File and directory creation, Unity prefab manipulation via external CLI execution (SKILL.md).
- Sanitization: Absent; the skill does not define validation or escaping logic for the asset paths before they are passed to the shell.
Audit Metadata