unity-csharp-scripting
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses a Python script (
scripts/check_unity_project.py) to analyze Unity project files such as scenes, prefabs, and C# scripts. These external files represent a potential attack surface where maliciously crafted assets could attempt to influence the agent's behavior via the script's reporting. - Ingestion points: Project files including
.unity,.prefab,.asset, and.csfiles are read and processed by the diagnostic script. - Boundary markers: The output of the Python script is not isolated with specific delimiters or instructions to ignore embedded commands.
- Capability inventory: The agent is authorized to execute the diagnostic script and subsequently modify project files to resolve errors found during the scan.
- Sanitization: The script uses regular expressions to extract structured metadata (GUIDs and class names) rather than providing the agent with raw file contents, which significantly reduces the risk of instruction leakage.
- [COMMAND_EXECUTION]: The skill's workflow involves the agent executing a provided Python script (
scripts/check_unity_project.py) within the project environment. While the script is local and utilizes only the Python standard library, it constitutes the execution of code provided with the skill.
Audit Metadata