audio-setup-mixers
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates C# code snippets at runtime based on project state and executes them using the
evalcommand in a live Unity Editor. This pattern is documented inSKILL.md(Step 0) and implemented inreferences/api.md(Assign groups section).\n - Evidence: The skill constructs a C#
Dictionaryand assignment logic from data discovered in the scene, which is then passed tounity command eval.\n- [INDIRECT_PROMPT_INJECTION]: The skill reads external, untrusted data from the Unity project (AudioClip and GameObject names) to guide its classification and code generation logic.\n - Ingestion points: Asset names are collected in
references/api.mdusingUnityEngine.Object.FindObjectsByType.\n - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat asset names as potentially untrusted data or to escape them before insertion into shell commands or C# snippets.\n
- Capability inventory: The skill can execute arbitrary C# code through the Unity CLI and has the ability to modify scene components and persist changes to the scene file.\n
- Sanitization: The instructions do not define sanitization or validation routines for asset names prior to their use in code generation.
Audit Metadata