optimize-web
Warn
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill frequently generates and executes C# code snippets at runtime using the
unity command evalcommand to interact with Unity Player Settings (SKILL.md). - [DYNAMIC_EXECUTION]: The skill provides a resource script,
WebOptimizer.cs, which is intended to be added to the project'sAssets/Editordirectory and executed at runtime via theExecuteMenuItemAPI (SKILL.md, resources/WebOptimizer.cs). - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze untrusted external data to drive its optimization workflow.
- Ingestion points: User-provided Build Reports and server header configuration data (SKILL.md).
- Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands in the ingested data.
- Capability inventory: Shell command execution via
unity-cli, dynamic C# evaluation, and file writing to theAssets/directory (SKILL.md, resources/WebOptimizer.cs). - Sanitization: Absent; external data is processed without explicit validation or filtering.
- [COMMAND_EXECUTION]: The skill includes instructions for the agent to execute shell commands to launch local development servers using
pythonandnpx(SKILL.md).
Audit Metadata