unity-game-workflow-control
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a CLI tool (
workflow-control.mjs) for state management, but it does not execute arbitrary shell commands or external processes. The logic is confined to manipulating local JSON records representing project state. - [DATA_EXFILTRATION]: No network-related operations, such as
curl,wget,fetch, orhttprequests, were detected in any of the scripts. Data operations are strictly limited to the local file system within the repository scope. - [PRIVILEGE_ESCALATION]: There are no attempts to acquire elevated permissions (e.g.,
sudo) or modify system configuration files. Path traversal is prevented through strict POSIX path canonicalization inio.mjsandworkflow-control.mjs. - [INDIRECT_PROMPT_INJECTION]: While the skill ingests external data from
Work ItemandEvidence Manifestfiles, it mitigates risk through comprehensive schema validation, revision tracking (CAS), and identity binding. It does not execute data content as instructions. - [OBFUSCATION]: The code is written in clear, plain-text JavaScript and Markdown. No base64-encoded payloads, homoglyphs, or hidden/obfuscated URLs were found.
- [REMOTE_CODE_EXECUTION]: The skill does not download external scripts or packages. It relies entirely on built-in Node.js modules and local files.
Audit Metadata