unity-skills-index
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill set is a well-structured collection of Unity Editor automation tools. It uses a bridge pattern to interact with Unity, requiring a local environment.
- [SAFE]: Extensive guardrails are implemented across all modules (e.g.,
script,gameobject,test) to prevent the agent from using non-existent tools or making common mistakes. - [SAFE]: No evidence of hardcoded credentials, sensitive file access, or suspicious network operations was found. Tools like
asset_importandscript_readare intended for local project management. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface common to code-editing tools. This is a low-risk observation consistent with the skill's primary purpose.
- Ingestion points: Tools such as
script_read(script/SKILL.md) anduitk_read_file(uitoolkit/SKILL.md) allow the agent to read arbitrary file content from the local project. - Boundary markers: The instructions lack explicit directives or delimiters to warn the agent against following instructions embedded within the files it reads.
- Capability inventory: The skill provides powerful project manipulation tools, including
script_create,script_replace(script/SKILL.md), andpackage_install(package/SKILL.md), which could be misused if the agent is influenced by malicious file content. - Sanitization: There is no specified sanitization or validation of the content ingested from the project environment.
Audit Metadata