hz-unity-fbx-import
Warn
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides a fallback mechanism in FALLBACK_MANUAL_IMPORT.md that directs the agent to generate and execute custom C# scripts using the Unity_RunCommand tool. This involves programmatic assembly of code to perform multi-stage operations like downloading, ZIP extraction, and material modification within the Unity Editor environment.
- [REMOTE_CODE_EXECUTION]: The manual import process involves using UnityWebRequest.Get() to download assets from remote URLs provided by the user, which are then processed by generated C# code. This creates a pathway for executing logic on externally sourced data.
- [COMMAND_EXECUTION]: The skill relies on the Unity_ImportExternalModel and Unity_RunCommand tools to perform operations on the host system within the Unity Editor context.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external files (FBX, ZIP) and remote URLs. Because the skill has high-privilege capabilities such as file writing and arbitrary code execution through the fallback mechanism, it presents an attack surface where malicious content in external assets could potentially influence agent operations. 1. Ingestion points: Remote URLs and local file paths for FBX and ZIP assets (SKILL.md, FALLBACK_MANUAL_IMPORT.md). 2. Boundary markers: None specified for external content. 3. Capability inventory: File writing (AssetDatabase), network operations (UnityWebRequest), and arbitrary code execution (Unity_RunCommand). 4. Sanitization: Instructions mention validating file extensions, but there is no deep inspection of asset content.
Audit Metadata