unity-package-management
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides Bash instructions to invoke the Unity Editor binary in batch mode using the -executeMethod flag to trigger the execution of generated C# scripts.
- [DYNAMIC_EXECUTION]: The skill generates and writes C# files (PackageInstaller.cs, PackageSearch.cs, and ProjectSaver.cs) to the project's Editor/ directory. These files are subsequently compiled and executed by the Unity Editor at runtime.
- [INDIRECT_PROMPT_INJECTION]: The skill processes package IDs and version strings which could originate from untrusted sources or user input. If malicious strings are provided, they could potentially influence the behavior of the generated scripts or the shell commands.
- Ingestion points: User-provided package IDs/versions and the project's Packages/manifest.json file.
- Boundary markers: None identified within the script generation templates.
- Capability inventory: The skill possesses the ability to write/edit files and execute shell commands via the Bash tool.
- Sanitization: There is no explicit validation or sanitization of package name strings before interpolation into C# code.
- [EXTERNAL_DOWNLOADS]: The reference documentation uses curl to fetch package metadata from the official Unity registry at https://packages.unity.com/. This is a vendor-owned resource used for legitimate package verification.
Audit Metadata