review-weekly
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a standard orchestrator for a Unity project review system. No malicious code, obfuscation, or persistence mechanisms were found.
- [COMMAND_EXECUTION]: The skill uses the
unilyzeCLI tool to perform various project analysis tasks, including health metrics, duplication checks, and diffing snapshots. This is the intended functionality for the review process. - [PROMPT_INJECTION]: The skill ingests data from external analysis tools and subagent outputs (Ingestion points: unilyze output, subagent responses). It utilizes markdown structure as a boundary (Boundary markers: markdown headers). The skill has file system write access and CLI execution capabilities (Capability inventory). No explicit sanitization is performed on the aggregated content (Sanitization). This identifies an indirect prompt injection surface inherent to data aggregation tasks.
Audit Metadata