uloop-unity-search
Pass
Audited by Gen Agent Trust Hub on Mar 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
uloopCLI utility, passing user-provided search queries and project paths as arguments to perform asset searches. - [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection based on the following evidence:
- Ingestion points: The skill searches and returns data from local Unity project files (e.g., scripts, scenes, prefabs).
- Boundary markers: No delimiters are specified to isolate search results from the agent's instruction context.
- Capability inventory: The skill executes CLI commands and provides a flag to save results to the local file system.
- Sanitization: There is no evidence of sanitization or content validation for the data retrieved from the Unity project.
Audit Metadata