unity-tooling
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents how to use AssetPostprocessor and ScriptedImporter, which act as ingestion points for external data (imported assets). 1. Ingestion points: AssetPostprocessor.OnPreprocessTexture and OnPreprocessModel in SKILL.md. 2. Boundary markers: Absent; logic uses basic path filtering. 3. Capability inventory: The code modifies internal Unity asset settings (e.g., texture compression, mipmapping). 4. Sanitization: Absent. Although this creates a surface for indirect instructions, the skill does not expose dangerous capabilities such as shell access, network requests, or file writes outside the Unity asset database.
- [SAFE]: The skill provides standard development guidance for Unity Editor extensions. The C# code adheres to platform best practices, including the use of #if UNITY_EDITOR directives for compilation safety. No malicious patterns, obfuscation, or unauthorized data access were found.
Audit Metadata