hz-unity-meta-quest-ui
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill uses templates that interpolate user-provided identifiers, such as Canvas names, into C# scripts and Meta Unity extension tools.
- Ingestion points: User-provided strings replace placeholders like "MenuUI" and "" in
SKILL.md. - Boundary markers: The instructions lack delimiters or explicit instructions for the agent to sanitize or escape user input before interpolation.
- Capability inventory: The skill uses
Unity_RunCommandwhich allows for arbitrary C# execution within the Unity Editor and Meta MCP tools that modify project hierarchy. - Sanitization: There is no provided logic for sanitizing or validating user-provided strings before they are embedded in executable scripts.
- [DYNAMIC_EXECUTION]: The skill relies on
Unity_RunCommandto generate and execute C# editor scripts at runtime based on provided templates for UI configuration and validation.
Audit Metadata