unity-cli
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing a local Unity CLI tool in the user's shell. It covers lifecycle management (
open), automated testing (test), batch execution (run), and headless builds (build). These instructions emphasize using the tool only when explicitly enabled in the project configuration. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with various local project files and command outputs, which serves as a potential ingestion surface for untrusted data if project files are malicious.
- Ingestion points: The skill reads
cli_config.json,ProjectVersion.txt,Library/UnityLockfile,~/.unity_skills/registry.json, and processes XML test reports and log files. - Boundary markers: The instructions do not define specific prompt delimiters for data interpolation but mandate the use of structured output (
--format json) to reduce misinterpretation of human-readable text. - Capability inventory: The skill uses shell execution to drive the Unity binary, allowing project launches, test runs, and build operations.
- Sanitization: The skill relies on machine-readable formats and non-interactive modes to prevent execution errors or prompt manipulation during parsing.
- [DYNAMIC_EXECUTION]: The
runandbuildcommands allow the execution of existing static C# methods (-executeMethod) within the Unity project. The documentation includes a safety directive to never add new build methods to a project without the user's explicit request.
Audit Metadata