unity-cloud-build
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the
membraneCLI to perform operations such as authentication, connection management, and executing actions against the Unity Cloud Build API. - [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the
@membranehq/clipackage from the NPM registry to provide the necessary tooling for the agent. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from Unity Cloud Build (via
membrane action runandmembrane request), which creates an attack surface for indirect prompt injection if the external data contains malicious instructions. - Ingestion points: Data returned from
membrane action runandmembrane requestcalls. - Boundary markers: None explicitly defined in the skill instructions to delimit external data from agent instructions.
- Capability inventory: The agent can execute CLI commands and make network requests through the Membrane proxy.
- Sanitization: There is no mention of sanitization or validation of the data retrieved from the external API before it is processed by the agent.
Audit Metadata