unity-asset-pipeline
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates entirely within the local Unity project context. All scripts (
validate_asset_manifest.py,check_scene_registry.py,inspect_3d_asset.py) are designed for deterministic technical validation and do not perform network operations or unauthorized file access. - [COMMAND_EXECUTION]: The
validate_asset_manifest.pyscript usessubprocess.runto invoke a secondary validation tool (validate_sprite.py). This execution is safe as it uses thesys.executableof the current environment and passes arguments as a list rather than a shell string, preventing shell injection vulnerabilities. The execution is restricted to internal scripts within the expected toolchain. - [DATA_EXPOSURE]: No hardcoded credentials or sensitive file paths (such as SSH keys or cloud provider configurations) were found. The scripts access project-specific files (.unity, .meta, .yaml, .json), which is necessary and appropriate for their stated purpose of asset pipeline management.
- [REMOTE_CODE_EXECUTION]: No remote script downloads or piped execution patterns (e.g.,
curl | bash) were detected in the instructions or scripts. All dependencies are local to the skill or standard project structure.
Audit Metadata