review-hotspot
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
unilyzecommand-line tool with specific arguments (hotspot -p <project>) to generate analysis reports. - [SAFE]: The skill operates entirely within the local development environment, reading git metadata and writing results to a designated report folder (
.unity-review/report/) within the project path. - [SAFE]: Indirect Prompt Injection Surface:
- Ingestion points: Git commit history and source code files processed via the
unilyzetool (SKILL.md). - Boundary markers: The skill uses a strict Markdown table schema for outputting findings, which restricts the interpretation of ingested data.
- Capability inventory: Limited to shell command execution for analysis and local file writing for reporting.
- Sanitization: The analysis focuses on extracting quantitative metrics (churn count and complexity scores), which minimizes the risk of the agent executing instructions embedded in code or commit messages.
Audit Metadata