uw-unity-project-setup
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates C# Editor scripts, specifically
Editor/Setup/PackageInstaller.csandEditor/Setup/ProjectConfigurator.cs, to handle package installation and modify Unity project settings. These scripts are generated at runtime based on the project configuration. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external configuration file to drive its setup logic.
- Ingestion points: The skill reads
docs/ProjectConfig.yamlfor project names, folder strategies, and package lists. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the YAML content as non-executable data.
- Capability inventory: The skill can create folders, write scripts, execute Git commands, and manage packages through MCP tools.
- Sanitization: The instructions do not specify any validation or sanitization steps for the values read from the configuration file before they are used in file system or script generation operations.
- [COMMAND_EXECUTION]: The skill performs shell-level operations for Git version control, including creating repositories, checking out branches, and performing initial commits. It also interacts with MCP servers for project and repository management.
Audit Metadata