unity-cli-sync-catalog
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script using
python "$HOME/.unity-cli-plugin/current/cli/cs.py" list-commands. This is a standard operation for the tool's functionality, utilizing a stable path within the user's home directory associated with the vendor's plugin. - [DATA_EXPOSURE]: The skill captures output from the CLI to compare command catalogs. The data processed is limited to Unity Editor command signatures (namespaces, command names, and arguments) and does not involve sensitive user files, credentials, or environment variables.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and parses JSON data returned by the
cs.pytool. While this represents an attack surface for indirect injection if the tool output were compromised, the risk is minimal as it processes structured command metadata from the local development environment.
Audit Metadata