unity-data-driven
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines data ingestion patterns for JSON and CSV files.\n
- Ingestion points: Untrusted data enters the agent context via the
WaveLoaderscript inSKILL.md(which reads JSON fromStreamingAssets) and theEnemyDataImporterinreferences/data-pipeline-patterns.md(which imports CSV text assets into the editor).\n - Boundary markers: The provided code snippets do not include explicit delimiters or instructions to ignore commands embedded within the data files.\n
- Capability inventory: The skill uses file system operations such as
File.ReadAllTextAsyncandAssetDatabase.CreateAsset, as well as network requests viaUnityWebRequestto process and store data.\n - Sanitization: There is no specific sanitization or validation logic provided for the ingested data beyond standard C# type-safe deserialization.\n- [SAFE]: The core logic of the skill focuses on legitimate Unity development best practices, including designer-friendly inspector attributes and data versioning techniques, and does not contain malicious code.
Audit Metadata