unity-code-reviewer
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
assets/code/HunkScanner.py.txtexecutes localgitcommands to identify modified lines for analysis.\n - Evidence: Uses
subprocess.check_outputwith static arguments to fetch diffs from the tracking branch or main branch.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external, untrusted C# source code which could contain adversarial patterns designed to trigger or evade diagnostics.\n - Ingestion points:
DiagnosticScanner.py.txtreads file content via standard file I/O, andHunkScanner.py.txtprocesses content from git diff outputs.\n - Boundary markers: None present; input data is processed directly as text for regex matching.\n
- Capability inventory: The included Python scripts are restricted to read-only analysis and console output; they lack network exfiltration or destructive file operations.\n
- Sanitization: The skill performs direct regex matching on raw source code strings without prior sanitization or escaping.
Audit Metadata