unity-game-3d-modeling
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill utilizes local Digital Content Creation (DCC) Model Context Protocol (MCP) tools which may execute scripts. It implements a strict security policy for these scripts, explicitly prohibiting operating system commands, network access, environment variable reads, and dynamic imports within the DCC environment.- [COMMAND_EXECUTION]: Execution of Unity CLI (
unity:unity-cli) and project-specific pipeline commands is central to the workflow. The skill mandates strict command discovery and schema matching, forbidding the use of guessed or unverified command names to prevent accidental or malicious execution of unintended binaries.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, including third-party generative AI vendors and various 3D model file formats (FBX, OBJ, glTF). This represents an attack surface for indirect prompt injection, which the skill manages through mandatory manual review cycles, 'play-mode' verification gates, and strict separation of roles to prevent automated execution of untrusted content.- [EXTERNAL_DOWNLOADS]: Integration with generative AI vendors involves external data transfers and asset retrieval. The skill requires per-task user approval for all vendor calls, cost confirmation, and data uploads, while ensuring API keys are stored in secure system storage rather than project files or logs.
Audit Metadata