The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides official installation instructions using curl | bash and irm | iex targeting public-cdn.cloud.unity3d.com, the official content delivery network for Unity Technologies. It also fetches standard project templates like .gitignore files from a well-known repository on raw.githubusercontent.com. These downloads are documented first-party operations.
[DYNAMIC_EXECUTION]: A core capability of the skill is driving a live Unity Editor session, which includes the ability to execute arbitrary C# code via the unity command eval command. This feature is intended for advanced automation and AI-assisted scene modification. The skill documentation includes clear security guidance, advising users to only provide trusted input and highlighting that execution occurs entirely within the local user's account and machine context.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to perform a wide range of Unity development tasks, such as creating projects, running tests, and managing builds. These commands are executed locally in the environment where the agent is running.
[PERSISTENCE]: The unity skill install command facilitates the installation of the agent's own instruction files into the configuration directories of various AI clients (e.g., .claude/skills). This is a documented administrative feature of the skill to enable its own discovery and use by AI agents, triggered only by explicit user command.
[INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface by reading external data sources like Unity Editor logs (Editor.log) and scene files. However, the documentation includes robust defensive instructions, explicitly warning the agent to treat log content as data rather than instructions and noting that terminal output is hardened against control-character injection to prevent terminal-based attacks.

unity-cli