The Agent Skills Directory

[COMMAND_EXECUTION]: The run_tests.py script uses subprocess.run to interact with the Unity CLI. The command is constructed as a list, which prevents shell injection vulnerabilities. The executable path is resolved from the system PATH using shutil.which('unity'). All parameters passed to the subprocess are either hardcoded or come from validated command-line arguments.
[DYNAMIC_EXECUTION]: The script utilizes the Unity CLI's eval command to execute C# code within the Unity Editor environment. All C# code strings evaluated are static literals defined within the script, such as UnityEditor.AssetDatabase.Refresh() and checks for EditorApplication.isCompiling. This design minimizes the risk of arbitrary code injection from untrusted data.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided specifications and tasks to guide the agent's work. While the agent follows instructions to run tests via run_tests.py, the script's use of structured subprocess calls and restricted command sets limits the potential for external data to influence the execution environment maliciously. Mandatory evidence chain:
Ingestion points: User-provided specifications and tasks processed by the agent (SKILL.md).
Boundary markers: The skill establishes a boundary in SKILL.md, restricting external package changes.
Capability inventory: Subprocess calls to the Unity CLI and file system access for logs and temporary scripts in .scratch/.
Sanitization: The Python script uses argparse for type-validated inputs and avoids shell execution for subprocesses.

unity-implement