migrate-birp-to-urp

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the unity command eval tool to execute arbitrary C# code within the user's active Unity Editor environment. This includes querying project settings, modifying assets, and capturing screenshots.
  • [DYNAMIC_EXECUTION]: The skill dynamically generates C# statement blocks and class files at runtime to perform complex operations like material property snapshotting and render pipeline conversion.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection.
  • Ingestion points: It uses UnityEditor.AssetDatabase.FindAssets and file scanning to inventory materials, shaders, and scenes within the local project.
  • Boundary markers: There are no explicit instructions or delimiters used when the agent processes the content of these project files to ensure it ignores embedded malicious instructions.
  • Capability inventory: The skill has access to the eval command, which allows for arbitrary C# execution, file system writes via System.IO.File, and modification of project settings via AssetDatabase and SerializedObject.
  • Sanitization: The skill lacks sanitization for data extracted from project files before it is used to influence subsequent migration phases or code generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 12:53 PM