unity-prefab-workflow

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses unity-cli via Bash to manage Unity prefab assets. The allowed-tools configuration correctly limits the scope of the Bash tool to the unity-cli binary.
  • [DYNAMIC_EXECUTION]: The runtime-checklist.md instructs the agent to use cargo run for local source execution if the unity-cli binary is unavailable in the current workspace.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data like prefab paths and object names, which are interpolated into tool commands. * Ingestion points: User instructions for prefab creation and instantiation in SKILL.md. * Boundary markers: None explicitly provided to separate user input from system instructions. * Capability inventory: Limited command execution via unity-cli and local code execution via cargo run. * Sanitization: The skill demonstrates the use of JSON payloads to wrap user-influenced arguments, providing a layer of protection against simple command injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 02:43 PM