profiler-save-data
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation suggests installing
unity-mcp-cliglobally usingnpm install -g unity-mcp-cli. This is an external dependency managed via the npm registry. - [COMMAND_EXECUTION]: The skill performs file system write operations using
System.IO.File.WriteAllTextto a location defined by thefilePathinput. This allows writing to arbitrary absolute or relative paths, which could potentially be used to overwrite important configuration files or scripts if the agent is misdirected. - [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection.
- Ingestion points: Data is aggregated from multiple profiler tools (
profiler-get-status,profiler-get-memory-stats, etc.) and thefilePathis provided via user input. - Boundary markers: None identified to distinguish between profiler data and metadata.
- Capability inventory: Performs file writes to the local file system.
- Sanitization: The skill does not explicitly describe sanitization or validation of the data being written to the file, meaning malicious content embedded in the profiler output could be persisted to the disk and executed or parsed by downstream processes.
Audit Metadata