fix-3d-physics-collisions
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill utilizes the
unity command script evalcapability to execute C# code within the user's Unity Editor. This is used to read project-wide physics settings and execute theCollisionDebuggerutility to track collision events at runtime.- [COMMAND_EXECUTION]: The skill uses theunityCLI tool to interact with the project environment, retrieve version information, and query project status.- [EXTERNAL_DOWNLOADS]: Fetches documentation and API reference data from official vendor sites includingdocs.unity.comanddocs.unity3d.comto ensure the agent has access to version-specific physics engine behavior.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external and local sources which could be used as vectors for indirect prompt injection. - Ingestion points: Fetches content from
docs.unity.comand reads local project files includingProjectSettings/DynamicsManager.assetandProjectSettings/ProjectVersion.txt. - Boundary markers: The skill does not define explicit delimiters or instructions to ignore embedded commands in fetched data.
- Capability inventory: Possesses capabilities for shell command execution, C# evaluation in the Editor, and file system modification (writing/deleting Editor scripts).
- Sanitization: No explicit sanitization or validation of external content is performed before it enters the agent's context.- [SAFE]: The skill includes a
SECURITY.mdfile that explicitly identifies the risk of adding Editor scripts and running code in the Editor. It justifies these as necessary for diagnostic purposes and mandates that the agent delete temporary scripts after use.
Audit Metadata