unity-editor-toolkit

No clear evidence of explicit malware (no network exfiltration, backdoor, or obfuscated payloads). The code, however, contains high-impact security risks: (1) ResetDatabaseAsync can delete an arbitrary file path (dbPath) derived from editor prefs and request parameters with no allow-list/path validation; (2) SQL queries are built with string interpolation for LIMIT rather than parameterization, which can enable query manipulation/DoS. These issues could be abused for sabotage or denial-of-service if the JSON-RPC endpoints are accessible to untrusted callers.

SUSPICIOUS: the core behavior is largely coherent with a Unity automation skill and data flow is local-only, but install trust is not fully verifiable because the package source is unspecified and unpinned. The skill has broad local project-control capability, so it is high impact but not clearly malicious from the provided content.

No direct malware is visible in this fragment (no obfuscated code, no explicit credential theft/exfiltration, no command execution). The main security concern is architectural: it exposes a high-privilege Unity Editor JSON-RPC/WebSocket control surface that dispatches untrusted requests to many capability handlers, with no authentication/authorization or origin/access controls evident here. The security posture therefore depends heavily on downstream validation and access control within the handler implementations and WebSocket service configuration; review those components for strict input validation, authorization checks, and safe handling of sendCallback-driven asynchronous responses.

This module exposes high-privilege Unity Editor actions via JSON-RPC and includes a dynamic reflection-based command execution mechanism: HandleExecute takes attacker-controlled commandName and invokes any runtime-discovered static void method annotated with [ExecutableMethod]. Additionally, HandleReimport accepts an unvalidated path that can be used to target/import assets. These patterns materially increase the likelihood of malicious supply-chain or sabotage abuse in an editor environment if the RPC endpoint is reachable or if any loaded dependency defines [ExecutableMethod] handlers.

This module exposes a high-capability JSON-RPC command surface over WebSocket inside the Unity Editor and forwards client-controlled method/category requests directly to handler implementations without authentication/authorization visible in this file. The biggest risks are (1) potential unauthorized editor actions/data exposure via handler.Handle(request), (2) lack of enforced timeouts (only logging), and (3) information leakage through returning/logging exception messages. No explicit malware/backdoor behavior is evident in this fragment, but security posture is highly dependent on the internal handler implementations and any external access controls.