unity-cinemachine
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documentation indicates the use of a runtime reflection adapter ('CinemachineAdapter' / 'CinemachineSkills') to bridge API differences between Cinemachine versions 2.x and 3.x. This allows the tool to dynamically resolve and set properties like 'propertyName' at runtime based on the detected environment.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted string data for identifying and configuring GameObjects and properties, which creates a potential surface for indirect prompt injection if the agent is processing data from untrusted sources.
- Ingestion points: Parameters in 'SKILL.md' such as 'vcamName', 'followName', 'lookAtName', and 'propertyName'.
- Boundary markers: No explicit delimiters or instructions to ignore embedded content within scene object names are defined in the provided metadata.
- Capability inventory: The skill allows for the creation, modification, and deletion of Unity components and GameObjects, as well as setting arbitrary properties via reflection.
- Sanitization: The skill performs basic semantic validation for specific enumerated fields like 'mode', but general property access is dictated by string identifiers provided at runtime.
Audit Metadata