unity-game-3d-texturing
Warn
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill enables the execution of dynamic scripts within local Digital Content Creation (DCC) software (e.g., Blender, Maya) via a Model Context Protocol (MCP) interface.
- Evidence: Instructions in
SKILL.mddefine a "high risk" handling policy for DCC code execution, limiting scripts to DCC-specific APIs, mathematics, and mesh operations while explicitly forbidding shell commands, networking, and environment access. - Evidence:
references/pbr-texture-workflow.mdmandates that only minimal, approved scripts are run, prohibiting access to credentials or files outside the project scope. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, potentially untrusted sources which could contain hidden instructions targeting the agent's logic.
- Ingestion points: Processes external "Visual Bible" documentation, generative AI image assets from third-party providers, and model/UV data files (
SKILL.md). - Boundary markers: Requires explicit approval records from an external supervisor agent (
$unity-game-grilling) for visual素材 and assets; mandates user confirmation for script execution and file overrides. - Capability inventory: The agent has access to
unity:unity-clifor project management, the ability to write to the filesystem (textures, materials), and the capability to execute DCC API scripts. - Sanitization: Relies on manual hash verification (SHA-256) of models and UVs and instructional constraints on script behavior to mitigate risks.
Audit Metadata