migrate-birp-to-urp
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs project migration and inspection by executing C# snippets within a live Unity Editor using the
unity command evaltool. This is the intended primary mechanism for interacting with the Unity project environment. - [DYNAMIC_EXECUTION]: The skill generates C# code at runtime, including statement blocks for immediate evaluation and full class files (e.g.,
MaterialSnapshot,CustomFullscreenEffectFeature) to be saved in the project'sAssets/Editor/directory for compilation and execution. This allows for complex state management and material restoration during the migration process. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from the Unity project, such as asset names, shader source code, and Unity Console logs.
- Ingestion points: Unity project files, scene metadata, and logs retrieved via
Unity.GetConsoleLogs. - Boundary markers: The skill does not use specific delimiters but mitigates risk through strict verification requirements, ensuring that tool logs are checked against the actual saved state of the project.
- Capability inventory: The skill has high capabilities, including arbitrary C# execution in the Editor, file system writes for visual captures, and package management.
- Sanitization: The skill relies on phased execution gates and human-in-the-loop rollback confirmations rather than automated sanitization of project data.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill captures Editor visuals (Scene and Game views) and saves them as PNG files in the system's temporary directory (
System.IO.Path.GetTempPath()) to allow the agent to verify migration results. These operations are local and no external network exfiltration of project data was observed.
Audit Metadata