unity
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the Unity CLI installer from the official Unity content delivery network (public-cdn.cloud.unity3d.com), which is a well-known and trusted service for engine-related binaries.
- [REMOTE_CODE_EXECUTION]: Instructions guide the user to pipe remote installation scripts directly into a shell interpreter (bash for Linux/macOS and iex for PowerShell). This installation pattern is restricted to official Unity domains.
- [DYNAMIC_EXECUTION]: The skill utilizes the
unity command evalandeval_filefeatures to execute C# code directly within a running Unity Editor. This is presented as a core capability for an agent to observe and manipulate the Editor state. The skill provides remediation guidance by recommending the use of registered static methods with argument validation instead of free-form strings where possible. - [COMMAND_EXECUTION]: It leverages the
unityCLI to perform automated builds, testing, and environment configuration through standard batch-mode shell commands. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific data (such as C# source files and serialized properties) which could potentially contain malicious instructions. The risk is mitigated by the intended use case of driving the developer's local Editor and the skill's recommendation for typed command structures over raw evaluation.
Audit Metadata