unity-compile-fixer
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill follows security best practices by implementing a mandatory confirmation step using the
AskUserQuestiontool. This ensures the agent never applies changes to the Unity project's source code without explicit user review and approval. - [INDIRECT_PROMPT_INJECTION]: The skill processes IDE diagnostics data as an external input. While this represents a potential surface for indirect prompt injection, the risk is mitigated by the use of a localized Node.js script (
scripts/analyze-diagnostics.js) that performs structured regex matching and a static reference database (references/error-patterns.json) to classify errors, rather than passing raw untrusted strings directly into a generative prompt. - [COMMAND_EXECUTION]: The skill executes a local Node.js script to transform diagnostic data. This script is bundled with the skill, uses safe JSON parsing methods, and does not perform network operations or execute arbitrary shell commands, making it a secure method for handling complex analysis logic.
Audit Metadata