sprite-editor
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the 'unity command eval' tool to execute agent-generated C# snippets within the Unity Editor. This is the intended functional mechanism for interacting with Unity's internal ISpriteEditorDataProvider API and is necessary for the developer workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface where malicious instructions embedded in Unity asset metadata (such as sprite names or paths) could influence the agent's behavior during processing.
- Ingestion points: Sprite names and metadata are ingested via 'ISpriteEditorDataProvider.GetSpriteRects()' as shown in the 'templates.md' file.
- Boundary markers: No special delimiters or instructions are used to differentiate untrusted asset data from the surrounding prompt context.
- Capability inventory: The skill possesses high-privilege capabilities including arbitrary C# execution via 'eval' and the ability to save/reimport assets via 'AssetImporter.SaveAndReimport()'.
- Sanitization: No sanitization or safety checks are performed on sprite names or metadata before they are incorporated into the agent's context.
Audit Metadata