Openclaw Unity Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:19 AM UTC
• Version: 1.7.0

Overview

The skill is openly designed to control Unity and has safety gates, but its legacy gateway HTTP path can expose and accept Unity session traffic without equivalent authentication.

Install only for trusted, version-controlled Unity projects. Keep the gateway and Unity bridge bound to localhost or a trusted network, prefer an OpenClaw version that uses authenticated registerHttpRoute, and do not enable OPENCLAW_EDITOR_ALLOW_DESTRUCTIVE unless you intend to approve specific project-changing calls with confirm: true.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: extension/index.ts:295

Finding

Unauthenticated legacy Unity bridge permits session hijacking and forged tool results

Content

View full analysis

{ const url = new URL(req.url ?? "/", "http://localhost"); const path = url.pathname; // Only handle /unity/* paths if (!path.startsWith("/unity/")) { return false; } // Handle CORS preflight if (req.method === "OPTIONS") { res.setHeader("Access-Control-Allow-Origin", "*"); res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS"); res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization"); res.statusCode = 204; res.end(); return true; } ``` The session registration endpoint accepts arbitrary clients without validating credentials: ```ts case "register": { if (req.method !== "POST") { sendJson(res, 405, { error: "Method not allowed" }); return true; } const body = await readJsonBody(req); const { project, version, platform, tools } = body; const sessionId = generateId(); const session: UnitySession = { sessionId, registeredAt: Date.now(), lastHeartbeat: Date.now(), projectName: project || "Unknown", unityVersion: version || "Unknown", platform: platform || "Unity ...[truncated 5522 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: README.md:77

Finding

Development build command downloads and executes a package without lockfile integrity verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

skill (`extension/index.ts`), so it covers every call routed through the OpenClaw

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · extension/dist/index.js (reported line 34)May include surrounding context.

js

var BATCH_TOOLS = /* @__PURE__ */ new Set(["batch.execute"]);
var MAX_BATCH_DEPTH = 4;
function currentEnv() {
  return globalThis?.process?.env ?? {};
}
function isTruthyFlag(value) {
  if (value === true) return true;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · extension/index.ts (reported line 94)May include surrounding context.

ts

var BATCH_TOOLS = /* @__PURE__ */ new Set(["batch.execute"]);
var MAX_BATCH_DEPTH = 4;
function currentEnv() {
  return globalThis?.process?.env ?? {};
}
function isTruthyFlag(value) {
  if (value === true) return true;

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file presents core descriptive and operational content in both English and Korean, and later sections provide important usage details only in Korean. This can impose a language expectation without explicitly offering language selection or stating that the skill is intended for a Korean-speaking audience.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 118)May include surrounding context.

openclaw unity status

Check skill available

ls ~/.openclaw/workspace/skills/unity-plugin/SKILL.md

text

## 🔐 Security: disableModelInvocation Setting

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

files under `Assets/`, installed packages, Play mode, and arbitrary C# run inside
the Editor process (`script.execute`, plus reflection-based calls).

**What runs without asking:** read-only tools only — `get*`, `list`, `find`,
`script.read`, `debug.hierarchy`, `debug.screenshot`, `console.getLogs`. Their
behaviour is unchanged.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation states that script.execute is a project-changing operation requiring confirm: true on every call, but several example calls omit that requirement. In a skill that enables arbitrary C# execution inside the Unity Editor, inconsistent examples can mislead operators or downstream tool-builders into invoking dangerous code without the intended confirmation flow, weakening the safety model even if the gateway may still refuse some calls at runtime.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation first states the project is under the MIT License, then immediately states it has been licensed under Apache-2.0 since its initial release. These statements cannot both be true as written, so the README actively contradicts itself about the project's licensing intent.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/tools.md (reported line 5)May include surrounding context.

md

Complete parameter reference for all ~100 tools.

> **Permissions:** read-only tools (`get*`, `list`, `find`, `script.read`,
> `debug.hierarchy`, `debug.screenshot`, `console.getLogs`) run directly. Every
> other tool listed here changes the project and is refused unless the gateway
> was started with `OPENCLAW_EDITOR_ALLOW_DESTRUCTIVE=1` **and** the call passes

Static analysis

No suspicious patterns detected.