scenario-unity-vfx
Warn
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
VfxGraphJobs.csuses reflection to invoke methods withinVfxGraphAuthoring.cs. The latter is designed to compile against internal Unity editor models (VFXGraph,VFXParameter,VFXBasicSpawner) by using a specific assembly name (Unity.Testing.VisualEffectGraph.EditorTests) that bypasses access restrictions via Unity'sInternalsVisibleToattribute. This allows the skill to perform unsupported authoring tasks in the Unity Editor. - [INDIRECT_PROMPT_INJECTION]: The skill implements functions to parse external
.vfx(YAML) assets and.pCachefiles for auditing (vfx_yaml_facts) and importing (ImportPointCache). Ingesting external, potentially untrusted project data into the agent's context is an indirect injection surface.
Audit Metadata