scene-get-data
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and suggests the installation of 'unity-mcp-cli' globally via the npm registry. This package is part of the author's ecosystem, designed to facilitate interaction between the agent and the Unity editor.\n- [COMMAND_EXECUTION]: The skill uses shell commands to invoke 'unity-mcp-cli', passing input parameters as JSON to query the Unity scene. This is the primary mechanism for the skill's functionality.\n- [PROMPT_INJECTION]: The skill processes data from Unity scenes, which constitutes an indirect prompt injection surface.\n
- Ingestion points: The tool retrieves GameObject names, tags, and serialized component data from the active Unity scene through the 'scene-get-data' tool described in SKILL.md.\n
- Boundary markers: The instructions do not specify any delimiters or warnings to treat the extracted Unity data as untrusted or potentially containing instructions.\n
- Capability inventory: The skill possesses the capability to execute shell commands and read project-specific data from the filesystem.\n
- Sanitization: There is no evidence of sanitization or validation of the ingested GameObject names or component values before they are presented to the agent.
Audit Metadata