unity-event
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts strings like 'methodName', 'stringArg', and JSON 'items' to configure UnityEvent listeners. These inputs represent a surface for indirect prompt injection if the agent populates them using untrusted external data (e.g., from files or web pages) without validation.
- Ingestion points: Input parameters for 'event_add_listener', 'event_set_listener', and 'event_add_listener_batch' in SKILL.md.
- Boundary markers: No delimiters or specific instructions to ignore embedded commands are defined for the input parameters.
- Capability inventory: The skill provides capabilities to modify persistent UnityEvent listeners and invoke them, which impacts the Unity project's state and runtime behavior.
- Sanitization: The documentation does not indicate any sanitization or strict validation for method names or argument values provided to the tools.
Audit Metadata