uloop-execute-dynamic-code

Warn

Audited by Socket on Mar 7, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

The skill aligns reasonably with its stated purpose of dynamic Unity Editor code execution for automation, with a focus on editor-only operations and explicit prohibitions on file writes. However, the capability to execute arbitrary C# snippets within the Unity context introduces meaningful risk: potential unintended modifications to assets/scenes, access to editor state, and possible surface for data leakage via logs or asset exports. The absence of explicit sandboxing, per-snippet permission prompts, or isolation mechanisms means the footprint is broader than a tightly scoped automation tool. The overall risk profile is moderate (suspicious-for-enhanced-risk tooling), warranting careful usage controls, audit logging, and possibly sandboxed execution contexts if deployed publicly.

Confidence: 65%Severity: 50%
Audit Metadata
Analyzed At
Mar 7, 2026, 01:01 AM
Package URL
pkg:socket/skills-sh/hatayama%2Fuloopmcp%2Fuloop-execute-dynamic-code%2F@8f5d8e11a93a4b6353ff365346e89e6f7f59a229