Security audit
Security checks for vulnerabilities and agentic risk
This Unity skill is coherent for editor automation, but it exposes powerful project-changing Unity controls through an unauthenticated bridge with weak safeguards.
Install only if you are comfortable giving OpenClaw broad control over a Unity project. Use it on test or version-controlled projects, keep the gateway reachable only from trusted local/private contexts, avoid arbitrary Git package installs and reflection script execution unless explicitly intended, and review the bridge authentication gap before using it with valuable projects.
extension/index.ts:82Unauthenticated Unity Bridge Permits Session Hijacking and Result Forgery
extension/index.ts:258Unrestricted Forwarding of Destructive and Execution-Capable Unity Tools
The description claims the skill controls the Unity Editor and supports a broad set of Unity development actions. However, the supplied code chunk does not implement any Unity Editor interaction at all. It is only an installation script for copying extension files into the user's OpenClaw extensions directory. While installation may support the larger skill, this chunk's actual behavior is materially different from the declared primary purpose, so this is a description/behavior mismatch for the supplied code.
The documented script.execute capability enables execution of arbitrary Unity/C# expressions, including reflection-based calls, which can modify project assets, game state, editor state, and potentially invoke sensitive APIs reachable from the Unity process. This materially exceeds narrow scene-inspection behavior and creates a powerful code-execution primitive that could be abused through prompts, social engineering, or overly broad tool approval.
The script.execute examples present code execution as routine convenience without warning that the action can arbitrarily mutate runtime state, editor state, assets, preferences, and invoke reflection-based methods. This makes a highly privileged primitive appear low-risk, which can mislead users and downstream agents into unsafe execution.
script.execute supports reflection-based method calls, which effectively exposes a broad code-execution surface inside the Unity process rather than a narrowly scoped editor-control API. An agent could invoke unintended methods, modify project or runtime state, access sensitive application internals, or trigger destructive behavior far outside the declared tool purpose.
script.execute is documented as supporting reflection-based execution but does not include an explicit warning about the breadth of actions it can trigger. Because this is effectively a powerful execution primitive inside the Unity/editor context, lack of safety framing materially increases the chance of unsafe or over-privileged use.
The file includes user-facing summary text in Korean, and substantial later guidance is also written only in Korean. There is no indication that the skill is region-specific or that users can choose their preferred language, which creates a natural-language locale policy concern.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
openclaw unity status
ls ~/.openclaw/workspace/skills/unity-plugin/SKILL.md
## 🔐 Security: disableModelInvocation Setting
The README presents two conflicting license claims: one section says MIT License while a later section says the project has been licensed under Apache-2.0 since initial release. Contradictory licensing can mislead users about redistribution, modification, and patent rights, creating legal and supply-chain risk for adopters integrating this skill or extension.
The trigger language is broad enough to activate on many normal Unity-related requests, increasing the chance that high-impact tools are surfaced in contexts where the user did not intend editor control or state-changing operations. Because this skill includes destructive, package-management, input-simulation, and code-execution features, overbroad matching raises the risk of accidental or socially engineered misuse.
The documentation normalizes destructive and state-changing operations such as object destruction, asset mutation, package installation, and scene changes without prominently warning about irreversible changes, backups, or confirmation expectations. In a tool meant to control a live Unity project, that omission increases the likelihood of accidental project damage or unsafe operator behavior.
The HTTP API under /unity/* allows registration, polling, result submission, heartbeat updates, and status access with no authentication or origin restrictions. Any local or reachable process can create fake sessions, enumerate real ones, interfere with command/result flow, or impersonate a Unity client, which expands control beyond the intended assistant-to-editor integration.
This code file registers a tool that advertises potentially destructive actions such as gameobject.delete, gameobject.create, and state-changing transform/app/input operations. Although the tool description lists available commands, it does not warn the user that invoking them can modify or delete Unity project/editor state, and there is no confirmation prompt before queuing the command.
Scene and prefab save operations persist changes to project files, but the reference does not clearly warn that these actions write durable state. In an autonomous or semi-autonomous agent context, silent persistence raises the risk of unintended project modifications being committed permanently.
Destructive object operations such as gameobject.destroy, gameobject.delete, and related asset deletion capabilities are presented without warning or confirmation expectations. In an agent-driven workflow, this increases the chance of accidental or prompt-induced destructive actions that remove scene content or project assets.
Input simulation tools can control the editor or game UI indirectly, triggering clicks, typing, and other actions that may bypass higher-level safety expectations. Without warnings, users and agents may underestimate that these tools can cause unintended destructive operations or interact with sensitive editor dialogs.
Modification and deletion tools for assets, materials, textures, and ScriptableObjects can alter or remove on-disk project content, yet the reference lacks clear safety warnings. This is dangerous because agents may treat these as routine operations and cause irreversible file changes or corrupt project state.
The documented ability to install packages from arbitrary Git URLs extends the plugin beyond local Unity editor control into fetching and introducing external code. That creates a supply-chain and remote code ingestion risk, especially if an agent can choose package sources dynamically or without strong user confirmation.
The 'Security' section contains key behavioral information entirely in Korean while the rest of the document is in English. This effectively forces a language choice for important safety guidance without opt-in or parallel English text.
The public status endpoint discloses session IDs, project names, Unity versions, platforms, and activity timestamps without access control. This information can help an attacker identify active targets and then use the unauthenticated session APIs to hijack or spoof Unity interactions.
No suspicious patterns detected.