unity-skills-index

Pass

Audited by Gen Agent Trust Hub on May 4, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill set is a well-structured collection of Unity Editor automation tools. It uses a bridge pattern to interact with Unity, requiring a local environment.
  • [SAFE]: Extensive guardrails are implemented across all modules (e.g., script, gameobject, test) to prevent the agent from using non-existent tools or making common mistakes.
  • [SAFE]: No evidence of hardcoded credentials, sensitive file access, or suspicious network operations was found. Tools like asset_import and script_read are intended for local project management.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface common to code-editing tools. This is a low-risk observation consistent with the skill's primary purpose.
  • Ingestion points: Tools such as script_read (script/SKILL.md) and uitk_read_file (uitoolkit/SKILL.md) allow the agent to read arbitrary file content from the local project.
  • Boundary markers: The instructions lack explicit directives or delimiters to warn the agent against following instructions embedded within the files it reads.
  • Capability inventory: The skill provides powerful project manipulation tools, including script_create, script_replace (script/SKILL.md), and package_install (package/SKILL.md), which could be misused if the agent is influenced by malicious file content.
  • Sanitization: There is no specified sanitization or validation of the content ingested from the project environment.
Audit Metadata
Risk Level
SAFE
Analyzed
May 4, 2026, 08:10 AM