sprite-editor
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with the Unity Editor using the
unity command evaltool to perform sprite modifications. This allows the agent to programmatically access Unity's internal APIs that are not exposed via standard CLI commands.\n- [DYNAMIC_EXECUTION]: The skill generates C# script snippets based on predefined templates (e.g., inreferences/templates.md) to perform slicing, pivot adjustments, and outline modifications. It enforces a "Safe Core Pattern" that requires checking importer capabilities before proceeding with any data modification, reducing the risk of accidental data corruption.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where user-provided data (like sprite names or file paths) is interpolated into C# snippets for execution viaeval.\n - Ingestion points: User-provided sprite names, asset paths, and slicing parameters (SKILL.md).\n
- Boundary markers: None identified for isolating user input within the generated C# strings.\n
- Capability inventory: Execution of arbitrary C# code within the Unity Editor process via
unity command eval(SKILL.md).\n - Sanitization: No explicit instructions for sanitizing or escaping user input before interpolation into code snippets were found.\n- [SAFE]: The skill's operations are consistent with its primary purpose of editing sprite assets. It does not perform network operations to untrusted domains, access sensitive system credentials, or employ obfuscation. All referenced Unity packages and namespaces are standard and appropriate for the context.
Audit Metadata