unity-dotween
Warn
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides capabilities to dynamically generate and write C# source code (
.csfiles) to the project viadotween_generate_tween_script,dotween_generate_sequence_script, anddotween_generate_lifetime_script. These actions trigger Unity's script compilation and domain reload processes. The skill's own metadata identifies these as high-risk operations due to the execution of the compiler on generated content. - [COMMAND_EXECUTION]: The skill allows for the modification of persistent project assets (such as
DOTweenSettings.assetviadotween_settings_configure) and the manipulation of Unity scene components (adding or removingDOTweenAnimationcomponents). These actions directly modify the project environment and editor state. - [INDIRECT_PROMPT_INJECTION]: The skill features a vulnerability surface where instructions embedded in external data could influence generated code.
- Ingestion points: The
stepsJsonparameter indotween_generate_sequence_scriptand various configuration parameters across thedotween_pro_*and generation suites. - Boundary markers: The skill description does not mention the use of delimiters or safety instructions to separate data from the code generation templates.
- Capability inventory: The skill possesses the ability to write executable files to the file system and modify scene hierarchies.
- Sanitization: While basic enum validation and numeric range checks are performed (e.g., validating durations and ease types), the documentation does not indicate sanitization of input strings used in code generation.
Audit Metadata