unity-uitoolkit

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill provides functions (uitk_create_editor_window, uitk_create_runtime_ui) that generate C# source code files within the Unity project. This is a legitimate development feature, and the skill documentation correctly identifies these actions as having significant side effects (domain reloads) and being subject to restricted execution modes requiring user consent.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local Unity project files via reading and inspection tools (uitk_read_file, uitk_inspect_uxml). This exposes the agent to a surface where content within project files could potentially contain instructions, though the structured nature of UXML and USS limits this risk.
  • [COMMAND_EXECUTION]: Destructive file system operations, specifically uitk_delete_file, are included in the module. These are identified as 'Delete' operations in the skill's metadata, enabling the host platform to apply necessary security gates for destructive actions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 09:28 PM