unity-uitoolkit
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides functions (uitk_create_editor_window, uitk_create_runtime_ui) that generate C# source code files within the Unity project. This is a legitimate development feature, and the skill documentation correctly identifies these actions as having significant side effects (domain reloads) and being subject to restricted execution modes requiring user consent.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local Unity project files via reading and inspection tools (uitk_read_file, uitk_inspect_uxml). This exposes the agent to a surface where content within project files could potentially contain instructions, though the structured nature of UXML and USS limits this risk.
- [COMMAND_EXECUTION]: Destructive file system operations, specifically uitk_delete_file, are included in the module. These are identified as 'Delete' operations in the skill's metadata, enabling the host platform to apply necessary security gates for destructive actions.
Audit Metadata