unity-game-3d-texturing

Warn

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill enables the execution of dynamic scripts within local Digital Content Creation (DCC) software (e.g., Blender, Maya) via a Model Context Protocol (MCP) interface.
  • Evidence: Instructions in SKILL.md define a "high risk" handling policy for DCC code execution, limiting scripts to DCC-specific APIs, mathematics, and mesh operations while explicitly forbidding shell commands, networking, and environment access.
  • Evidence: references/pbr-texture-workflow.md mandates that only minimal, approved scripts are run, prohibiting access to credentials or files outside the project scope.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, potentially untrusted sources which could contain hidden instructions targeting the agent's logic.
  • Ingestion points: Processes external "Visual Bible" documentation, generative AI image assets from third-party providers, and model/UV data files (SKILL.md).
  • Boundary markers: Requires explicit approval records from an external supervisor agent ($unity-game-grilling) for visual素材 and assets; mandates user confirmation for script execution and file overrides.
  • Capability inventory: The agent has access to unity:unity-cli for project management, the ability to write to the filesystem (textures, materials), and the capability to execute DCC API scripts.
  • Sanitization: Relies on manual hash verification (SHA-256) of models and UVs and instructional constraints on script behavior to mitigate risks.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 2, 2026, 01:17 PM