unity-pipeline

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill provides commands like eval, eval_file, run_script, and reload_file to compile and execute C# code within a running Unity process. While this is a powerful capability, it is the primary intended function for automating Unity development tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection as the agent is instructed to read and process untrusted data from the local project, including C# source files and audit results in CSV format.
  • Ingestion points: Local source files (e.g., Assets/*.cs, AgentScripts/*.cs) and the output of unity command audit.
  • Boundary markers: None specified in the instructions to separate data from commands.
  • Capability inventory: The agent can execute C# code and modify local files through the unity CLI.
  • Sanitization: No explicit sanitization or filtering of the ingested source code or CSV data is mentioned.
  • [COMMAND_EXECUTION]: The skill relies on the unity command-line utility to communicate with local Unity servers operating on specific port ranges (7800-7849 for Editor and 7900-7949 for Runtime).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 05:47 PM