assets-refresh
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the user to install the 'unity-mcp-cli' package globally using
npm install -g unity-mcp-clior to run it vianpx. This is an external dependency necessary for the skill to communicate with the Unity Editor. - [COMMAND_EXECUTION]: The tool operates by executing shell commands, specifically
unity-mcp-cli run-tool assets-refresh, which interfaces with Unity's internal APIs. - [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface because it triggers the compilation and execution of C# scripts ('.cs' files) that may have been modified by external processes. This is documented as a functional feature for Unity project maintenance. Mandatory evidence chain: 1. Ingestion points: Unity project Assets folder; 2. Boundary markers: None; 3. Capability inventory: Triggers Unity AssetDatabase.Refresh and subsequent C# compilation; 4. Sanitization: None.
Audit Metadata