unity-perception
Pass
Audited by Gen Agent Trust Hub on Mar 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scene_export_reportandscene_dependency_analyzefunctions allow users to specify asavePath. This capability allows the agent to create or overwrite files on the local filesystem. While intended for reports, it lacks explicit path validation in the definition to prevent potential path traversal. - [PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection by ingesting untrusted data from the Unity environment, such as GameObject names, tags, and C# script content.
- Ingestion points: Scene hierarchy names, component properties, and C# source code analyzed in
scene_contextandscene_export_report. - Boundary markers: None explicitly defined in the prompt templates to distinguish between scene data and instructions.
- Capability inventory: File-writing capabilities are present in
scene_export_reportandscene_dependency_analyze. - Sanitization: No sanitization or filtering of scene-derived strings is mentioned before they are processed or exported.
Audit Metadata