manage-sprite-atlas

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill generates Unity Editor scripts that execute during the build pipeline using the IPreprocessBuildWithReport interface. These scripts perform file system operations such as creating directories and saving assets using Unity's SpriteAtlasAsset.Save and AssetDatabase APIs. These operations are confined to the Unity project's Assets/ directory and represent standard development workflows.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface as it scans project folders and file names to automatically categorize sprites into atlases. While this is a theoretical vector for indirect injection (e.g., specially crafted filenames), the skill includes a mandatory validation step IsValidProjectSprite in spriteatlasprebuildgenerator.cs that restricts processing to the Assets/ folder and explicitly excludes Packages/, mitigating risks from external dependencies. The capabilities are limited to asset configuration within the Unity environment.
  • [SAFE_PRACTICES]: The skill demonstrates high-quality security hygiene by: 1. Tagging all generated scripts with a unique identifier [UNITY-SKILL:SPRITEATLAS] to prevent unauthorized modifications or duplicate generation. 2. Enforcing strict separation between Editor and Runtime contexts to prevent credential or sensitive data leakage during gameplay. 3. Providing explicit warnings and documentation regarding common API errors and invalid patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 03:38 AM