unity-audit
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
npxcommand to run therepomixutility on the provided input directory. - [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute therepomixpackage from the official NPM registry. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading and auditing C# source code from an external directory, which could contain malicious prompt injection attempts targeting the auditing agent.
- Ingestion points: C# files (
**/*.cs) within the specified<input-directory>are read and packed into arepomix-output.xmlfile for auditing. - Boundary markers: There are no explicit delimiters or system instructions provided to the agent to distinguish between its own audit logic and potentially malicious instructions within the audited source code.
- Capability inventory: The skill utilizes shell command execution (
npx) and file system access to read project contents. - Sanitization: The skill does not perform any sanitization, filtering, or validation of the source code content before processing.
Audit Metadata