new-unity-project
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute numerous commands via the
unityCLI, includingunity projects create,unity auth login,unity license activate, andunity pipeline install. These are standard operations for project bootstrapping and licensing within the Unity ecosystem. - [EXTERNAL_DOWNLOADS]: The skill references and suggests installing additional agent skills from the official Unity Technologies GitHub repository (
github.com/Unity-Technologies/skills). It also directs users to the Unity Personal EULA. All referenced URLs are owned by the vendor and are used for legitimate project configuration. - [DYNAMIC_EXECUTION]: During the 'Visual Baseline' phase (Step 7), the skill generates C# code recipes to be executed within the Unity Editor. These scripts configure render settings, camera properties, and UI stacks. This dynamic code generation is restricted to the context of the locally running Unity Editor and is a core feature for automated project setup.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of a user-provided 'concept prompt' which is parsed to define the game genre, dimensions, and scope. It also writes a 'forward baton' instruction to the project's
CLAUDE.mdorAGENTS.mdfile. The skill mitigates risks by using an 'assumptions manifest' that prints all planned actions for user review before execution and requires explicit consent before writing to project-level documentation.
Audit Metadata