unity-yooasset
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes Unity Editor API methods to automate the asset bundle build pipeline and manage collector configurations within the project.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill allows reading local build reports (.report) and importing scanner configurations (.json) from user-specified paths. Additionally, it supports network communication with external build cache servers via the
cacheServerHostparameter. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data files that could be influenced by an attacker. Ingestion points:
yooasset_load_build_reportandyooasset_import_assetart_scanner_config. Boundary markers: None are implemented to distinguish between data and instructions. Capability inventory: Includes the ability to write files to the project directory and modify Unity Editor settings. Sanitization: No content sanitization is described for the ingested files. - [DYNAMIC_EXECUTION]: Several skills allow providing class names for encryption and manifest processing services, which involves dynamic loading and reflection-based execution within the Unity Editor environment.
Audit Metadata