urp-postprocessing
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill leverages the
unity command evaltool to execute dynamically generated C# statement blocks within a live Unity Editor. While the skill provides specific templates for graphics configuration inSKILL.mdandreferences/code-templates.md, this mechanism allows for arbitrary C# execution in the target environment. - [INDIRECT_PROMPT_INJECTION]: The skill translates high-level user requests (e.g., cinematic or horror visual styles) into executable code snippets. This design creates a vulnerability surface where adversarial user input could attempt to influence the logic of the generated C# code.
- Ingestion points: User queries regarding post-processing effects, bloom, tonemapping, and other volume overrides (referenced in
SKILL.md). - Boundary markers: The templates do not employ explicit boundary markers or delimiters to isolate user-provided values from the code logic.
- Capability inventory: The skill utilizes the
unity command evalcapability to perform file system operations viaAssetDatabase, object modification viaUndo, and runtime state changes via theVolumeframework (referenced inreferences/code-templates.md). - Sanitization: There is no evidence of sanitization or validation of user-provided parameters before they are interpolated into the C# snippets.
Audit Metadata