generate-editor-search-query

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill programmatically generates C# code at runtime to interface with the UnityEditor.Search.SearchService API. This code is constructed from a template and executed dynamically via the Unity CLI to perform UI actions within the editor.
  • [COMMAND_EXECUTION]: The skill relies on the unity command eval tool to execute generated C# snippets. The implementation instructions also involve using shell commands such as base64 and tr to prepare the query data for insertion into the code block.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting natural language user prompts and translating them into search queries that are executed within the Editor environment.
  • Ingestion points: User prompts requesting searches for assets or scene objects, which are processed by the instructions in SKILL.md and references/query-patterns.md.
  • Boundary markers: The skill uses Base64 encoding as a boundary to separate untrusted user-provided query text from the trusted C# code structure and shell command syntax.
  • Capability inventory: The agent can execute C# code in the Editor using eval and perform local file operations to stage data for encoding, as documented in references/open-search-window.md.
  • Sanitization: The skill mandates Base64 encoding of all user-controlled search terms, effectively sanitizing the input by ensuring it cannot contain characters (like quotes or shell operators) that would allow for command breakout or code injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 02:02 AM