unity-game-grilling
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill operates as a decision-recording and questioning framework with high-security constraints. It includes explicit instructions to avoid unauthorized writing to Unity project directories (Assets, Packages, ProjectSettings) and prohibits the recording of credentials, personal data, or restricted contract text. It also incorporates integrity checks via SHA-256 and requires host-based identity verification for approvals.
- [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface as it reads project documentation (GDD/TDD, contracts, and plans) which could contain untrusted instructions. However, the risk is mitigated by strict execution boundaries, a requirement for manual user approval for all decisions, and explicit prohibitions against storing sensitive data.
- Ingestion points: Reads project plans, GDD/TDD, resource contracts, and Visual Bible documentation (SKILL.md).
- Boundary markers: Explicitly requires separating verified facts from assumptions and producing versioned decision summaries (SKILL.md).
- Capability inventory: Limited to writing to
docs/control-plane.mdand machine-readable records (grilling-record); prohibits writing to Unity core project files before approval. - Sanitization: Instructions explicitly forbid recording credentials, personal data, or sensitive contract content (SKILL.md).
Audit Metadata