profiler-save-data

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation suggests installing unity-mcp-cli globally using npm install -g unity-mcp-cli. This is an external dependency managed via the npm registry.
  • [COMMAND_EXECUTION]: The skill performs file system write operations using System.IO.File.WriteAllText to a location defined by the filePath input. This allows writing to arbitrary absolute or relative paths, which could potentially be used to overwrite important configuration files or scripts if the agent is misdirected.
  • [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection.
  • Ingestion points: Data is aggregated from multiple profiler tools (profiler-get-status, profiler-get-memory-stats, etc.) and the filePath is provided via user input.
  • Boundary markers: None identified to distinguish between profiler data and metadata.
  • Capability inventory: Performs file writes to the local file system.
  • Sanitization: The skill does not explicitly describe sanitization or validation of the data being written to the file, meaning malicious content embedded in the profiler output could be persisted to the disk and executed or parsed by downstream processes.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 12:15 PM