unity-skills-index
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides the
editor_execute_menufunction, which allows the AI agent to execute arbitrary menu commands within the Unity Editor environment. - [REMOTE_CODE_EXECUTION]: The
script_create,script_append, andscript_replacemodules enable the generation and modification of C# scripts. These scripts are subsequently compiled and executed by the Unity Editor's internal systems. - [EXTERNAL_DOWNLOADS]: The
package_installskill facilitates the installation of Unity packages from the official Unity Package Manager registry. - [PROMPT_INJECTION]: The skill processes untrusted project data, creating a surface for indirect prompt injection.
- Ingestion points: Ingests project source code and scene hierarchy through
script_read,script_analyze, andscene_export_report. - Boundary markers: Ingested data is structured as JSON before being returned to the agent context.
- Capability inventory: Possesses extensive file system access (
asset_delete,script_replace) and editor command execution capabilities. - Sanitization: The skill descriptions do not specify sanitization or comment-stripping during the parsing of C# scripts.
Audit Metadata