script-update-or-create
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill writes C# source code to the project file system, which Unity automatically compiles and executes upon
AssetDatabase.Refresh(). This creates a direct path for executing dynamically generated content. - [INDIRECT_PROMPT_INJECTION]: The skill processes code provided in the
contentparameter without semantic sanitization. Ingestion points: Thecontentinput field inSKILL.md. Boundary markers: None. Capability inventory: Local file system write access and execution via the Unity editor environment. Sanitization: Syntax validation via Roslyn is performed, but there is no analysis to detect malicious logic or unintended side effects in the generated C# code. - [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: Troubleshooting instructions recommend the installation of the
unity-mcp-clipackage via npm. This package is the primary tool used by the skill to interface with the Unity Editor.
Audit Metadata