unity-pipeline
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides commands like
eval,eval_file,run_script, andreload_fileto compile and execute C# code within a running Unity process. While this is a powerful capability, it is the primary intended function for automating Unity development tasks. - [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection as the agent is instructed to read and process untrusted data from the local project, including C# source files and audit results in CSV format.
- Ingestion points: Local source files (e.g.,
Assets/*.cs,AgentScripts/*.cs) and the output ofunity command audit. - Boundary markers: None specified in the instructions to separate data from commands.
- Capability inventory: The agent can execute C# code and modify local files through the
unityCLI. - Sanitization: No explicit sanitization or filtering of the ingested source code or CSV data is mentioned.
- [COMMAND_EXECUTION]: The skill relies on the
unitycommand-line utility to communicate with local Unity servers operating on specific port ranges (7800-7849 for Editor and 7900-7949 for Runtime).
Audit Metadata