hz-unity-meta-mixed-reality-utility-kit
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documentation includes methods for loading scene data from external JSON strings, which creates a potential surface for indirect prompt injection if ingested room data contains malicious instructions in anchor labels or metadata.
- Ingestion points:
MRUK.LoadSceneFromJsonStringinSKILL.md. - Boundary markers: None identified.
- Capability inventory: Unity scene manipulation, NavMesh generation, and prefab spawning.
- Sanitization: No input validation for the scene JSON is described.
- [DYNAMIC_EXECUTION]: To facilitate interaction with the MRUK assembly from limited environments like Unity MCP, the skill documents a reflection-based approach to resolve types and invoke methods at runtime.
- Evidence: Implementation details in
SKILL.mdunder the 'Calling SDK Methods via Unity MCP' section usingSystem.Reflectionpatterns.
Audit Metadata