skills/clasen/wardx/wardx-unity/Gen Agent Trust Hub

wardx-unity

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is a standard SDK implementation for Unity telemetry and remote configuration. It emphasizes security best practices such as not storing secrets in Remote Config and hashing sensitive identifiers (user IDs) locally using a mandatory PrivacySalt before transmission. Vendor-specific package installation via git is consistent with standard Unity development workflows.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides an ingestion surface for remote configuration via Config.Get and generates logs through Log.Error. While these could theoretically carry instructions for downstream agent actions, the skill's scope is restricted to telemetry and instrumentation. Mandatory evidence chain: (1) Ingestion points: Remote configuration snapshots fetched from the server via the sync transport; user-provided identifiers via Identify. (2) Boundary markers: None explicitly defined in the prompts for configuration values. (3) Capability inventory: Network transmission of telemetry frames (POST /v1/sync) and potential code modification by an agent based on error logs. (4) Sanitization: Local hashing of user identifiers using PrivacySalt before transmission; recommendation to clip stack traces in log attributes.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 05:50 PM
Security Audit — agent-trust-hub — wardx-unity