unity-skill-create
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill enables the creation of C# source files that are automatically compiled and executed by the Unity Editor, providing a mechanism for arbitrary code execution within the development project context.
- [COMMAND_EXECUTION]: The skill facilitates system-level operations by invoking the unity-mcp-cli tool.
- [EXTERNAL_DOWNLOADS]: The skill references the installation and usage of the unity-mcp-cli package from the npm registry, which is a resource managed by the skill's vendor.
- [PROMPT_INJECTION]: The skill provides an indirect prompt injection surface by accepting and writing arbitrary code to the filesystem. (1) Ingestion points: The code parameter in the skill input. (2) Boundary markers: None present to delimit user-provided code from instructions. (3) Capability inventory: Ability to write .cs files and interact with the Unity Editor API. (4) Sanitization: No internal validation or filtering is performed on the provided code snippet.
Audit Metadata