unity-yooasset

Pass

Audited by Gen Agent Trust Hub on Aug 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes Unity Editor API methods to automate the asset bundle build pipeline and manage collector configurations within the project.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill allows reading local build reports (.report) and importing scanner configurations (.json) from user-specified paths. Additionally, it supports network communication with external build cache servers via the cacheServerHost parameter.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data files that could be influenced by an attacker. Ingestion points: yooasset_load_build_report and yooasset_import_assetart_scanner_config. Boundary markers: None are implemented to distinguish between data and instructions. Capability inventory: Includes the ability to write files to the project directory and modify Unity Editor settings. Sanitization: No content sanitization is described for the ingested files.
  • [DYNAMIC_EXECUTION]: Several skills allow providing class names for encryption and manifest processing services, which involves dynamic loading and reflection-based execution within the Unity Editor environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 16, 2026, 08:54 AM
Security Audit — agent-trust-hub — unity-yooasset