unity-cli

SUSPICIOUS. The overall purpose is coherent for a Unity automation skill, and the localhost API use matches Unity's experimental Pipeline feature. However, install trust is weaker than claimed: the main setup path relies on an unprovided local script, the Docker image is community-run rather than Unity-owned, and the auth guidance uses plaintext credentials in env vars instead of the current official flow. This looks more like a risky or outdated automation guide than confirmed malware.

This module is primarily an installation/validation wrapper for Unity CLI. It shows no explicit credential theft or covert behavior in the visible code, but it performs high-sensitivity supply-chain actions by downloading and executing remote installer scripts directly (curl|bash and irm|iex) without visible integrity verification. Treat integration into CI/pipelines as high-risk unless the downstream installer scripts are verified via pinned hashes/signatures and the download is constrained/validated.