skills/firzus/agent-skills/unity/Gen Agent Trust Hub

unity

Warn

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill documents the usage of unity command eval and unity command eval_file in cli.md, which allow for the compilation and execution of C# code within the Unity Editor at runtime. This capability enables the agent to perform arbitrary logic execution on the host machine.
  • [COMMAND_EXECUTION]: The skill provides guidance in cli.md for using the unity CLI to perform operations such as unity build, unity test, and unity open, giving the agent the ability to execute commands in the shell environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface where untrusted code or data could be processed by an agent with high-privilege execution capabilities.
  • Ingestion points: Reviewing source code, project assets, and utilizing the eval_file command in cli.md.
  • Boundary markers: No specific delimiters or safety warnings are implemented to separate untrusted content from the execution context.
  • Capability inventory: Access to shell commands via the unity CLI and arbitrary C# execution through the eval feature (both in cli.md).
  • Sanitization: The instructions do not include steps for sanitizing external inputs or validating code before execution.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 8, 2026, 09:47 PM