generate-editor-search-query
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands via
unity command evalto interact with the Unity Editor. This is a primary capability used to trigger Editor UI actions such as opening the Search window. - [DYNAMIC_EXECUTION]: The skill constructs C# statement blocks at runtime using a predefined template found in
references/open-search-window.md. These snippets are then passed to the Editor's evaluation engine for execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied search terms, asset names, and folder paths as ingestion points. These values are interpolated into the C#
querystring literal within the code template. To mitigate injection risks, the instructions provide specific sanitization rules, such as doubling double-quotes to ensure the verbatim string literal (@"") remains intact and the user data is not interpreted as code. A validation checklist is also included to ensure the agent reports failures and fallbacks correctly.
Audit Metadata