unity-material

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Unity project assets, creating a potential surface for indirect prompt injection.
  • Ingestion points: material_get_properties and material_get_keywords fetch property names, descriptions, and keyword lists from Unity material assets.
  • Boundary markers: The skill does not explicitly describe the use of delimiters or instructions to ignore embedded content within the asset data.
  • Capability inventory: The skill possesses the ability to create, duplicate, and modify material assets on disk (material_create, material_duplicate, material_set_*).
  • Sanitization: No explicit sanitization or filtering of material property values or names is mentioned before they are returned to the agent context.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 06:24 PM