The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill includes installation instructions that pipe remote scripts from the official Unity CDN (public-cdn.cloud.unity3d.com) directly into the shell (bash or PowerShell). As this is the verified distribution channel for the vendor, Unity Technologies, it is considered a safe and intended reference.
[DYNAMIC_EXECUTION]: The skill documentation describes the use of unity command eval and unity command eval_file, which allow the execution of arbitrary C# code within a running Unity Editor instance. This is a core feature of the com.unity.pipeline package designed to enable agents to interact with the game engine live.
[INDIRECT_PROMPT_INJECTION]: The skill provides tools that ingest data from external sources such as version control history, system logs, and third-party integrations (Jira), creating a potential surface for indirect prompt injection.
Ingestion points: Data is ingested through commands that read project metadata, VCS summaries (vcs summarize), and Editor logs.
Boundary markers: The skill documentation warns the agent to treat log contents as data rather than instructions.
Capability inventory: The toolset allows for arbitrary C# evaluation, shell command execution, and project file modification.
Sanitization: The CLI implements terminal output hardening to strip control characters and escape sequences from server-provided metadata to prevent terminal injection attacks.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform system-level operations and interact with the Unity CLI binary.

unity-cli