migrate-birp-to-urp
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses
unity command evalto execute C# statement blocks directly in the Unity Editor and generates C# scripts at runtime in theAssets/Editor/directory for complex tasks like material snapshots and lighting configuration. - [COMMAND_EXECUTION]: The skill invokes the
unity commandtool to interact with the Unity Editor, enabling project auditing, package installation, and render pipeline assignment. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-controlled asset data such as material properties and shader names, creating an attack surface for indirect injection. Evidence Chain: 1. Ingestion points: Unity assets and configuration files (materials, shaders, scenes) read via
AssetDatabaseand C#System.IO. 2. Boundary markers: None present. 3. Capability inventory: Local file writes, asset modification, and command evaluation. 4. Sanitization: No specific sanitization detected for project-derived data interpolated into execution contexts.
Audit Metadata