unity-development-loop
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill suggests a fallback mechanism to execute the local source code using
cargo run -- <args>if theunity-clibinary is not found in the system PATH. - Evidence: Found in
references/runtime-checklist.mdwhere it recommends using the Rust compiler to run the project's own tools. - [COMMAND_EXECUTION]: The skill facilitates the execution of various
unity-clisubcommands to manage Unity instances, enter play mode, and simulate inputs. - Evidence: The
allowed-toolsinSKILL.mdincludesBash(unity-cli:*), and specific commands likeunity-cli system pingandunity-cli instances set-activeare documented inreferences/runtime-checklist.md. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and analyze external data such as Unity console logs and UI component states, which could potentially contain untrusted content if the Unity project itself is compromised.
- Ingestion points: Unity console output, logs, and UI state reads (referenced in
SKILL.mdandreferences/development-loop-playbook.md). - Boundary markers: Not explicitly defined in the provided instructions.
- Capability inventory: Shell command execution via
unity-cliand file system access viaRead,Grep, andGlobtools. - Sanitization: No explicit sanitization or filtering of log content is mentioned before the agent processes it.
Audit Metadata