unity-prefab-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
unity-cliviaBashto manage Unity prefab assets. Theallowed-toolsconfiguration correctly limits the scope of theBashtool to theunity-clibinary. - [DYNAMIC_EXECUTION]: The
runtime-checklist.mdinstructs the agent to usecargo runfor local source execution if theunity-clibinary is unavailable in the current workspace. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data like prefab paths and object names, which are interpolated into tool commands. * Ingestion points: User instructions for prefab creation and instantiation in
SKILL.md. * Boundary markers: None explicitly provided to separate user input from system instructions. * Capability inventory: Limited command execution viaunity-cliand local code execution viacargo run. * Sanitization: The skill demonstrates the use of JSON payloads to wrap user-influenced arguments, providing a layer of protection against simple command injection.
Audit Metadata