optimize-web

Warn

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill frequently generates and executes C# code snippets at runtime using the unity command eval command to interact with Unity Player Settings (SKILL.md).
  • [DYNAMIC_EXECUTION]: The skill provides a resource script, WebOptimizer.cs, which is intended to be added to the project's Assets/Editor directory and executed at runtime via the ExecuteMenuItem API (SKILL.md, resources/WebOptimizer.cs).
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze untrusted external data to drive its optimization workflow.
  • Ingestion points: User-provided Build Reports and server header configuration data (SKILL.md).
  • Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands in the ingested data.
  • Capability inventory: Shell command execution via unity-cli, dynamic C# evaluation, and file writing to the Assets/ directory (SKILL.md, resources/WebOptimizer.cs).
  • Sanitization: Absent; external data is processed without explicit validation or filtering.
  • [COMMAND_EXECUTION]: The skill includes instructions for the agent to execute shell commands to launch local development servers using python and npx (SKILL.md).
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 10, 2026, 02:55 PM
Security Audit — agent-trust-hub — optimize-web