urp-postprocessing
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill leverages the
unity command evaltool to execute dynamically generated C# statement blocks in a connected Unity Editor. This allows for runtime modification of Volume profiles, camera settings, and asset creation, which is a powerful capability restricted to the local development environment.\n- [COMMAND_EXECUTION]: The instructions involve invoking theunity-clitool to interact with the Unity Editor's command catalog and execute C# snippets via theevalcommand, representing direct command-line interaction with the host system's development tools.\n- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect prompt injection by searching for and operating on scene objects (e.g.,GameObject.Find). If the agent is instructed to use user-defined object names from an untrusted scene in the C# snippets it generates, malicious names could potentially be used to influence the code logic, although the current implementation uses hardcoded defaults for common tasks.
Audit Metadata