unity-mcp-bridge
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
execute_codetool to run C# 6 code within the Unity Editor environment. This functionality is intended for legitimate editor automation, reflection, and build tasks as documented in the workflows. - [EXTERNAL_DOWNLOADS]: The skill references and fetches the
unity-mcppackage from the official CoplayDev GitHub repository and uses the well-known OpenUPM registry (package.openupm.com) for package management, representing standard Unity development practices. - [PROMPT_INJECTION]: The skill processes data from the Unity console and editor resources. While this creates a potential surface for indirect prompt injection if those logs or assets contain adversarial text, no malicious instructions were found in the skill's handling of this data.
- [DATA_EXFILTRATION]: The skill communicates with a local Unity Editor via a WebSocket server on localhost (
http://127.0.0.1:8080/mcp). No unauthorized network connections to unknown or suspicious external domains were identified.
Audit Metadata