new-unity-project

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute various project management commands via the unity CLI, including unity auth, unity license, unity install, unity projects create, and unity open. It also utilizes standard git commands for version control initialization and commits.
  • [INDIRECT_PROMPT_INJECTION]: The skill represents an indirect prompt injection surface by ingesting untrusted data through user responses.
  • Ingestion points: User input gathered via AskUserQuestion for project names and descriptions in SKILL.md.
  • Boundary markers: None explicitly mentioned; however, the user is asked to confirm the project brief before proceeding.
  • Capability inventory: The skill has access to shell execution via Bash for CLI operations and file system access via Read, Write, and Edit.
  • Sanitization: No explicit sanitization or validation of the user-provided project name or brief is documented before these values are passed to shell commands (e.g., unity projects create "<Name>").
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 12:45 PM
Security Audit — agent-trust-hub — new-unity-project