unity-material
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Unity project assets, creating a potential surface for indirect prompt injection.
- Ingestion points:
material_get_propertiesandmaterial_get_keywordsfetch property names, descriptions, and keyword lists from Unity material assets. - Boundary markers: The skill does not explicitly describe the use of delimiters or instructions to ignore embedded content within the asset data.
- Capability inventory: The skill possesses the ability to create, duplicate, and modify material assets on disk (
material_create,material_duplicate,material_set_*). - Sanitization: No explicit sanitization or filtering of material property values or names is mentioned before they are returned to the agent context.
Audit Metadata