Unity copies Agent Skills between local directories. Skills may contain scripts or instructions that agents can execute later.

Treat third-party skills as untrusted code. Review imported skills before syncing them into agents with broad tool access.

Report security issues privately to the project maintainers. Do not open a public issue for vulnerabilities that could enable code execution, credential exposure, or unsafe file deletion.