unity-3d-generator
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads 3D mesh assets (GLB, FBX) and rendered preview images from
https://api.tripo3d.ai/v2/openapi. While these are necessary for the skill's primary function, the domain is not on the standard whitelisted list. - [DATA_EXFILTRATION]: Local image files are read and uploaded to the Tripo API to support image-to-3D generation tasks. This represents exposure of local project assets to a third-party service.
- [COMMAND_EXECUTION]: The skill executes Python scripts and shell commands to manage the asset pipeline. It specifically instructs the agent to source user shell profiles (
~/.zprofile,~/.zshrc) to resolve environment variables, which is a common but sensitive operation. - [DYNAMIC_EXECUTION]: Instructions in
references/unity-import.mdandreferences/prerender-2d.mdrequire the agent to execute C# code snippets directly in the Unity Editor via theunity-mcp-bridge. These scripts perform file system operations and modify asset metadata. - [INDIRECT_PROMPT_INJECTION]: The skill ingests mesh data and JSON responses from an external API. It mitigates potential risks by implementing mandatory validation scripts (
inspect_3d_asset.py,validate-rig,validate-animation) and realized Unity import gates that verify asset properties before production use.
Audit Metadata