Security audit

Openclaw Unity Skill

Security checks across malware telemetry and agentic risk

Overview

This Unity skill is legitimate editor automation, but it gives an agent very broad project-changing and code-running power that users should review carefully before enabling.

Install only for trusted, local, version-controlled Unity projects. Review commands before they run, especially script.execute, deletes, saves, package installs, batch actions, and keyboard or mouse simulation. Keep backups or source control ready, and do not expose the Unity/OpenClaw bridge beyond a trusted local environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The manifest description says only that the plugin connects the Unity Editor to the assistant, but the skill metadata indicates far broader and higher-risk capabilities including arbitrary C# execution, reflection-based editor calls, scene and asset modification, and play-mode/input control. This mismatch can mislead users or reviewers about the plugin's true power, reducing informed consent and increasing the chance that dangerous actions are enabled inappropriately.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The unity_execute tool exposes a generic command bridge to a connected Unity Editor and the metadata explicitly states it supports destructive actions and arbitrary C# execution via the plugin ecosystem. In this file, there is no policy enforcement, allowlist, confirmation gate, or per-tool restriction before queuing commands, so an agent can trigger scene/asset modifications or code execution without an explicit user approval checkpoint.

Vague Triggers

Low

Confidence: 84% confidence
Finding: The description does not define when the plugin should be activated or what user intent should trigger it, even though the surrounding skill context says it should only be used for explicit Unity Editor requests. Without activation constraints, an agent may invoke a highly privileged Unity bridge too broadly, causing unintended editor actions or increasing the attack surface for prompt-induced misuse.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This reference lists destructive and state-changing operations such as scene save/load and object deletion as routine tools without inline warnings, confirmations, or trust-boundary guidance. In an agent skill, that omission is risky because an LLM may treat these actions as normal housekeeping and modify or destroy project state based on ambiguous user prompts.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The documentation exposes script.execute as supporting reflection-based method calls and arbitrary project logic execution, but the reference text does not provide a strong warning about the full consequences. In this skill context, that effectively gives the agent a code-execution primitive inside the Unity Editor, enabling modification of scenes, assets, settings, editor state, and any reachable project code path.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.