unity-skill-generate
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation suggests installing the
unity-mcp-clipackage via NPM (npm install -g unity-mcp-cli) to interact with the skill. - [COMMAND_EXECUTION]: The skill instructions provide shell command examples for executing system tools via
unity-mcp-cli. - [PROMPT_INJECTION]: The skill facilitates the generation of agent instructions from external sources, specifically Unity C# attributes (
[AiSkillDescription]and[AiSkillBody]). This creates a surface for Indirect Prompt Injection. - Ingestion points: Project-level MCP tool registration and C# source code attributes in
SKILL.md. - Boundary markers: None specified for the generated content body.
- Capability inventory: File system write operations (
GenerateSkillFiles) to the project directory. - Sanitization: The skill description notes that absolute paths and
..traversal segments are rejected, though it does not specify sanitization for the instruction content itself.
Audit Metadata