unity-game-spine-reskin
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes complex external assets including Spine projects and Unity metadata, which inherently creates a surface for indirect prompt injection if these assets originate from untrusted sources.\n
- Ingestion points: The agent is instructed to read .spine source files, JSON/Binary exports, Atlas assets, and Unity SkeletonDataAsset files located in the project directory.\n
- Boundary markers: The workflow mandates strict structural freezing and the generation of SHA-256 hashes for baseline evidence to detect unauthorized modifications in the source files.\n
- Capability inventory: The skill requires writing to a JSON ledger file (batch-ledger.json) and interacting with the Unity Editor and Spine Editor environments.\n
- Sanitization: The instructions emphasize version matching between editors and runtimes, and require a full regression mapping of assets to ensure they conform to the existing skeleton structure before final integration.
Audit Metadata