package-add

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). SKILL.md describes package-add as installing a Unity package specified by the caller-provided packageId (registry/Git URL/local path) but does not indicate that the required runtime workflow reads outsider-authored free text from an untrusted feed/queue without selecting a specific item.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly accepts Git package URLs at runtime (e.g., https://github.com/user/repo.git and https://github.com/user/repo.git#v1.0.0) and installing such packages modifies manifest.json and triggers package resolution/domain reload, which can fetch and execute remote code from those repositories.