generate-editor-search-query

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the unity CLI tool to execute commands in the Unity Editor environment, specifically utilizing the eval subcommand to process C# code snippets.
  • [DYNAMIC_EXECUTION]: The skill generates C# statement blocks at runtime using a predefined template to open the Unity Search window. It provides instructions to ensure the generated code is a valid statement block and uses fully qualified types since using directives are not supported in the evaluation context.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes natural language search requests from the user and interpolates them into the C# code snippet template.
  • Ingestion points: User prompts and chat attachments identifying asset names, paths, or types in SKILL.md.
  • Boundary markers: None explicitly defined for the prompt input, though instructions require the agent to choose the 'simplest query' possible.
  • Capability inventory: Execution of C# via unity command eval as described in references/open-search-window.md.
  • Sanitization: The skill contains explicit mitigation instructions in SKILL.md ("Escape the query safely in the generated C# string") and references/open-search-window.md ("If the query contains double quotes, double them inside the verbatim C# string") to prevent input from breaking out of the C# string literal.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 05:29 PM
Security Audit — agent-trust-hub — generate-editor-search-query