unity-primetween

Warn

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The functions primetween_generate_tween_script and primetween_generate_sequence_script create new C# MonoBehaviour files and write them to the Assets/Scripts/PrimeTween directory. In the Unity Editor, this triggers an automatic compilation process, effectively executing the generated code within the development environment.
  • [REMOTE_CODE_EXECUTION]: The skill requires the installation of the external Unity package com.kyrylokuzyk.primetween. While this is a common community package, it represents a dependency on external code that the skill expects to be present in the environment.
  • [INDIRECT_PROMPT_INJECTION]: The primetween_generate_sequence_script tool accepts a stepsJson parameter which ingest structured data to define the logic of the generated code.
  • Ingestion points: stepsJson parameter in primetween_generate_sequence_script (SKILL.md).
  • Boundary markers: None identified in the prompt templates.
  • Capability inventory: File system writes (C# script generation) which trigger Unity's compilation engine.
  • Sanitization: The skill description implies standard JSON parsing but does not explicitly document validation or sanitization of the operation types before code generation.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 25, 2026, 07:00 PM
Security Audit — agent-trust-hub — unity-primetween