ui-ugui
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection due to its core functionality of reading and analyzing external project data.
- Ingestion points: As described in the 'Scope' and 'Workflow' sections, the agent analyzes existing Canvas hierarchies and .prefab UI files.
- Boundary markers: The instructions do not specify any delimiters or safety warnings for the agent to ignore instructions embedded within the hierarchy (e.g., in GameObject names or Text component strings).
- Capability inventory: The agent is empowered to generate C# code, modify the project hierarchy, and execute Unity Editor APIs based on its analysis.
- Sanitization: There are no instructions to sanitize or validate the data read from the UI hierarchy before processing.
- [EXTERNAL_DOWNLOADS]: The skill references the import of TextMeshPro (TMP) essential resources using Unity APIs.
- It correctly recommends using
TMP_PackageResourceImporter.ImportResources()to avoid blocking the agent with interactive modal dialogs. - These resources are official components of the Unity ecosystem and are considered safe platform-level assets.
Audit Metadata