unity-plugin

Unity Plugin Skill

Control Unity Editor through ~100 built-in tools. Works in both Editor and Play mode.

Safety and permissions

What this skill can change: anything the Unity Editor can — GameObjects and components, scenes, prefabs, materials, shaders, textures and ScriptableObjects, files under Assets/, installed packages, Play mode, and arbitrary C# run inside the Editor process (script.execute, plus reflection-based calls).

What runs without asking: read-only tools only — get*, list, find, script.read, debug.hierarchy, debug.screenshot, console.getLogs. Their behaviour is unchanged.

What is gated at runtime: every project-changing tool — create, delete, destroy, save, set*, component.add/remove, asset.* writes, prefab.*, material.*, texture.*, editor.refresh/recompile, Play-mode control, input simulation, test.run, script.execute — and any batch.execute that carries one of them. The gateway extension refuses these by default. A tool name it does not recognise (project-registered custom tools included) counts as project-changing unless its verb is clearly read-only: the gate fails closed, never open.

How to enable them — both steps are required:

1. The operator starts the gateway with the opt-in environment variable. It is read from the gateway process, so the model cannot set it:

   OPENCLAW_EDITOR_ALLOW_DESTRUCTIVE=1 openclaw gateway restart
   # or, scoped to this skill only:
   OPENCLAW_UNITY_ALLOW_DESTRUCTIVE=1 openclaw gateway restart
   

2. The caller passes confirm: true on each project-changing call, after the user has approved that specific change:

   unity_execute: asset.delete {path: "Assets/Old/Item.prefab"}, confirm: true
   

Missing either one is a refusal with an explanation of what was blocked and how to allow it. Nothing reaches the Editor in the meantime.

Preview first: dryRun: true reports how a call is classified and what would be sent, and sends nothing: