wardx-unity
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a standard SDK implementation for Unity telemetry and remote configuration. It emphasizes security best practices such as not storing secrets in Remote Config and hashing sensitive identifiers (user IDs) locally using a mandatory
PrivacySaltbefore transmission. Vendor-specific package installation via git is consistent with standard Unity development workflows. - [INDIRECT_PROMPT_INJECTION]: The skill provides an ingestion surface for remote configuration via
Config.Getand generates logs throughLog.Error. While these could theoretically carry instructions for downstream agent actions, the skill's scope is restricted to telemetry and instrumentation. Mandatory evidence chain: (1) Ingestion points: Remote configuration snapshots fetched from the server via the sync transport; user-provided identifiers viaIdentify. (2) Boundary markers: None explicitly defined in the prompts for configuration values. (3) Capability inventory: Network transmission of telemetry frames (POST /v1/sync) and potential code modification by an agent based on error logs. (4) Sanitization: Local hashing of user identifiers usingPrivacySaltbefore transmission; recommendation to clip stack traces in log attributes.
Audit Metadata