new-unity-project
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute various project management commands via the
unityCLI, includingunity auth,unity license,unity install,unity projects create, andunity open. It also utilizes standardgitcommands for version control initialization and commits. - [INDIRECT_PROMPT_INJECTION]: The skill represents an indirect prompt injection surface by ingesting untrusted data through user responses.
- Ingestion points: User input gathered via
AskUserQuestionfor project names and descriptions inSKILL.md. - Boundary markers: None explicitly mentioned; however, the user is asked to confirm the project brief before proceeding.
- Capability inventory: The skill has access to shell execution via
Bashfor CLI operations and file system access viaRead,Write, andEdit. - Sanitization: No explicit sanitization or validation of the user-provided project name or brief is documented before these values are passed to shell commands (e.g.,
unity projects create "<Name>").
Audit Metadata