tools-unity-state-machine
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The C# code examples use
Activator.CreateInstance(transitionData.Installer)within theEnterStatemethod to dynamically instantiate state installers. While common in Unity dependency injection frameworks, this allows for the execution of arbitrary types based on metadata. - [INDIRECT_PROMPT_INJECTION]: The skill defines a state navigation system that ingests untrusted transition data, creating a potential vulnerability surface if the data source is attacker-controlled.
- Ingestion points: The
NavigateToandNavigateToAdditivemethods inSKILL.mdacceptIStateTransitionDataobjects. - Boundary markers: None are present in the provided implementation patterns to delimit or validate the transition data.
- Capability inventory: The system performs dynamic object instantiation via
Activator.CreateInstanceinSKILL.md. - Sanitization: There is no evidence of type validation or an allow-list for the
Installertype before it is used for instantiation.
Audit Metadata