scenario-unity-performance

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The Python toolkit in scripts/ut_perf.py utilizes subprocess.Popen to launch the Unity editor and built game players for automated benchmarking. These operations, including the use of native macOS tools like xctrace for GPU analysis, are consistent with the skill's primary purpose of measuring application performance.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by ingesting and parsing external data, including Unity player logs in scripts/AgentKit/Performance/PerfShaders.cs and Profiler capture files in scripts/AgentKit/Performance/PerfCapture.cs. However, the data is processed for technical analysis (e.g., variant counting, wait marker classification), and no evidence of malicious behavior or instructions was detected. The ingestion of performance data is a core requirement for the skill's diagnostic capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 07:17 AM