uloop-find-game-objects
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
uloopcommand-line tool to query information from the Unity Editor, which is the intended functionality of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill defines a data ingestion surface that processes data from potentially untrusted Unity projects.
- Ingestion points: GameObject names, paths, and component property values are read from the hierarchy.
- Boundary markers: No delimiters or warnings are used to mark the boundaries of the ingested project data.
- Capability inventory: The skill documentation notes it is often used before the
execute-dynamic-codetool. - Sanitization: There is no evidence of data sanitization or validation performed on the retrieved properties.
Audit Metadata