unity-development-loop

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill suggests a fallback mechanism to execute the local source code using cargo run -- <args> if the unity-cli binary is not found in the system PATH.
  • Evidence: Found in references/runtime-checklist.md where it recommends using the Rust compiler to run the project's own tools.
  • [COMMAND_EXECUTION]: The skill facilitates the execution of various unity-cli subcommands to manage Unity instances, enter play mode, and simulate inputs.
  • Evidence: The allowed-tools in SKILL.md includes Bash(unity-cli:*), and specific commands like unity-cli system ping and unity-cli instances set-active are documented in references/runtime-checklist.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and analyze external data such as Unity console logs and UI component states, which could potentially contain untrusted content if the Unity project itself is compromised.
  • Ingestion points: Unity console output, logs, and UI state reads (referenced in SKILL.md and references/development-loop-playbook.md).
  • Boundary markers: Not explicitly defined in the provided instructions.
  • Capability inventory: Shell command execution via unity-cli and file system access via Read, Grep, and Glob tools.
  • Sanitization: No explicit sanitization or filtering of log content is mentioned before the agent processes it.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 02:44 PM