create-2d-physics
Warn
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
unity command evalto execute arbitrary C# code within the context of the user's running Unity Editor. This grants the agent the ability to perform any action the user can perform within the Unity process. - [DYNAMIC_EXECUTION]: The skill employs runtime code generation to probe for Unity physics systems and execute configuration logic. For example, it uses a hardcoded C# snippet to check for the presence of specific physics assemblies in the current AppDomain.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local development environment, such as existing project scripts and scene configurations, to decide which physics system to implement. This poses a risk that malicious instructions within these files could be interpreted by the agent during code generation.
- Ingestion points: Local project scripts and Unity scene component data accessed during Step 0.
- Boundary markers: Absent; there are no specific delimitation or filtering instructions provided to protect against instructions embedded in user-provided files.
- Capability inventory:
unity command eval(C# execution) andWebFetch(network communication). - Sanitization: No sanitization or validation of the generated C# code against side effects is mentioned.
- [EXTERNAL_DOWNLOADS]: The skill uses
WebFetchto retrieve documentation from Unity's official domains (docs.unity.comanddocs.unity3d.com). These references are neutral and follow well-known service patterns for the Unity ecosystem.
Audit Metadata