generate-editor-search-query
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill programmatically generates C# code at runtime to interface with the
UnityEditor.Search.SearchServiceAPI. This code is constructed from a template and executed dynamically via the Unity CLI to perform UI actions within the editor. - [COMMAND_EXECUTION]: The skill relies on the
unity command evaltool to execute generated C# snippets. The implementation instructions also involve using shell commands such asbase64andtrto prepare the query data for insertion into the code block. - [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by ingesting natural language user prompts and translating them into search queries that are executed within the Editor environment.
- Ingestion points: User prompts requesting searches for assets or scene objects, which are processed by the instructions in
SKILL.mdandreferences/query-patterns.md. - Boundary markers: The skill uses Base64 encoding as a boundary to separate untrusted user-provided query text from the trusted C# code structure and shell command syntax.
- Capability inventory: The agent can execute C# code in the Editor using
evaland perform local file operations to stage data for encoding, as documented inreferences/open-search-window.md. - Sanitization: The skill mandates Base64 encoding of all user-controlled search terms, effectively sanitizing the input by ensuring it cannot contain characters (like quotes or shell operators) that would allow for command breakout or code injection.
Audit Metadata