assets-prefab-open
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The documentation references the installation of
unity-mcp-clivia npm. This is a vendor-specific command-line tool (matching the author 'ivanmurzak') necessary for the skill's intended operation within the Unity ecosystem. - [COMMAND_EXECUTION]: The skill facilitates interaction with the Unity Editor by executing shell commands through the
unity-mcp-cliutility. This is the primary mechanism for the tool's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data which presents a theoretical attack surface.
- Ingestion points: The
gameObjectRefinput parameter inSKILL.md, includingpath,name, andassetPathfields, which are populated from the active Unity project hierarchy. - Boundary markers: None explicitly defined in the input schema to separate data from instructions.
- Capability inventory: The skill executes shell commands (
unity-mcp-cli) and modifies the Unity Editor state (SKILL.md). - Sanitization: Input is constrained by a JSON schema, providing structural validation, though it does not explicitly filter for natural language instructions within the strings.
Audit Metadata