migrate-birp-to-urp
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the
unity command evaltool to execute arbitrary C# code within the user's active Unity Editor environment. This includes querying project settings, modifying assets, and capturing screenshots. - [DYNAMIC_EXECUTION]: The skill dynamically generates C# statement blocks and class files at runtime to perform complex operations like material property snapshotting and render pipeline conversion.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection.
- Ingestion points: It uses
UnityEditor.AssetDatabase.FindAssetsand file scanning to inventory materials, shaders, and scenes within the local project. - Boundary markers: There are no explicit instructions or delimiters used when the agent processes the content of these project files to ensure it ignores embedded malicious instructions.
- Capability inventory: The skill has access to the
evalcommand, which allows for arbitrary C# execution, file system writes viaSystem.IO.File, and modification of project settings viaAssetDatabaseandSerializedObject. - Sanitization: The skill lacks sanitization for data extracted from project files before it is used to influence subsequent migration phases or code generation.
Audit Metadata