unity-agentic-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted natural language input, such as bug feedback and user requests, to autonomously drive task implementation and defect resolution cycles.
- Ingestion points: User-provided feedback and requests handled by the
task-bugandcreate-tasklogic inSKILL.md. - Boundary markers: Utilizes a delimited managed lifecycle block within the
contract.mdfile to isolate state from immutable authority. - Capability inventory: The skill performs file system writes (task contracts and defect evidence), executes version control tools (Git, Plastic), and invokes the
unity-clifor project management across various scripts. - Sanitization: There is no explicit mechanism described for sanitizing or escaping user-provided feedback before it is incorporated into task artifacts or used as arguments for downstream command logic.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the official
Unity-Technologies/unity-agent-pluginfrom its marketplace. This is a reference to a tool from a well-known service provider and is documented neutrally without escalating the verdict.
Audit Metadata