unity-development-workflow

Pass

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/capture_windows_runtime.py uses subprocess.Popen to launch the built game executable for the purpose of capturing runtime screenshots.
  • Evidence: subprocess.Popen([str(executable), *args.launch_arg], ... shell=False) in scripts/capture_windows_runtime.py.
  • Context: This is a standard QA feature for game development; the execution is secured by a robust path resolution utility that restricts targets to .exe files within the Artifacts/Builds directory and explicitly validates every path segment to prevent symlink-based escapes from the project root.
  • [EXTERNAL_DOWNLOADS]: The automation logic specifies dependencies on standard, established Python libraries for data validation and image processing.
  • Evidence: Script headers for scripts/workflow.py and scripts/capture_windows_runtime.py define requirements for jsonschema, PyYAML, and Pillow.
  • [SAFE]: The skill incorporates an extensive internal integrity and validation system across both its C# toolkit and Python orchestration scripts.
  • Evidence: ManifestLoader.cs (C#) and contracts.py (Python) implement recursive SHA-256 and subject-identity verification for all development 'contracts' (YAML/JSON jobs), ensuring that workflow data has not been tampered with and is correctly bound to the current project version.
  • Evidence: Path handling logic in WorkflowPaths.cs and resolve_project_path implements advanced security checks, including reparse point (symlink/junction) detection, to prevent directory traversal attacks in multi-user development environments.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 28, 2026, 02:20 PM
Security Audit — agent-trust-hub — unity-development-workflow