unity-cli
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
setup.shscript downloads and executes the official Unity CLI installation script frompublic-cdn.cloud.unity3d.com. While the script uses a piped-to-shell pattern, the source is the official domain of a well-known service (Unity). - [COMMAND_EXECUTION]: The skill facilitates the execution of various
unity-clicommands for project lifecycle management, including installation, licensing, building, and testing. - [CREDENTIALS_UNSAFE]: The documentation provides guidance on using environment variables (
UNITY_SERIAL,UNITY_EMAIL,UNITY_PASSWORD) and secrets in CI/CD environments (e.g., GitHub Secrets), which aligns with secure configuration practices rather than hardcoding credentials. - [EXTERNAL_DOWNLOADS]: Fetches configuration and installation scripts from Unity's official content delivery network and references developer resources on the author's GitHub Pages site.
- [DATA_EXFILTRATION]: Interacts with a local API endpoint (
localhost:14000) via the experimental Unity Pipeline package to query engine state and execute C# code snippets in a running Editor instance. These operations are restricted to the local machine and use time-limited tokens.
Audit Metadata