create-2d-physics

Warn

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to use unity command eval to execute arbitrary C# code within the context of the user's running Unity Editor. This grants the agent the ability to perform any action the user can perform within the Unity process.
  • [DYNAMIC_EXECUTION]: The skill employs runtime code generation to probe for Unity physics systems and execute configuration logic. For example, it uses a hardcoded C# snippet to check for the presence of specific physics assemblies in the current AppDomain.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local development environment, such as existing project scripts and scene configurations, to decide which physics system to implement. This poses a risk that malicious instructions within these files could be interpreted by the agent during code generation.
  • Ingestion points: Local project scripts and Unity scene component data accessed during Step 0.
  • Boundary markers: Absent; there are no specific delimitation or filtering instructions provided to protect against instructions embedded in user-provided files.
  • Capability inventory: unity command eval (C# execution) and WebFetch (network communication).
  • Sanitization: No sanitization or validation of the generated C# code against side effects is mentioned.
  • [EXTERNAL_DOWNLOADS]: The skill uses WebFetch to retrieve documentation from Unity's official domains (docs.unity.com and docs.unity3d.com). These references are neutral and follow well-known service patterns for the Unity ecosystem.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 24, 2026, 12:38 PM