generate-editor-search-query
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local shell commands including
base64,tr, andrmto process search query data, and uses theunityCLI to communicate with the Unity Editor. - [DYNAMIC_EXECUTION]: The skill generates C# code at runtime based on a static template to interact with the Unity Editor's
SearchService. This code is executed via theunity command evalinterface. This is a controlled execution of a specific UI-related API (SearchService.ShowWindow). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest natural language input from users to generate search queries, creating a potential surface for indirect injection.
- Ingestion points: User-provided search requests and asset/scene object names processed in
SKILL.md. - Boundary markers: None explicitly defined for user input; however, the skill provides strict translation rules in
references/query-patterns.md. - Capability inventory: Local shell execution and arbitrary C# execution via
unity command evalas described inreferences/open-search-window.md. - Sanitization: The skill implements a critical mitigation by requiring the agent to Base64-encode the generated search query before interpolating it into the C# snippet. This prevents user-controlled text from escaping C# string literals or shell command quoting, ensuring the query is treated as data rather than code.
Audit Metadata