optimize-audio

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill interacts with the Unity Editor by compiling and executing C# snippets at runtime via the unity command eval tool. These snippets are sourced from templates within the resources/audio-import-api.md file and are used to audit and modify audio import settings. This constitutes dynamic code generation and execution as a core functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data such as asset paths and GameObject names from the Unity project environment, as documented in the scene enumeration recipes in resources/audio-import-api.md. The evidence shows a lack of boundary markers or sanitization for these external inputs. Combined with the skill's capability to execute arbitrary C# code in the Editor (via eval), this presents a surface for indirect prompt injection if project assets are maliciously named, although the skill includes checkpoints requiring user confirmation before applying changes.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 09:41 AM
Security Audit — agent-trust-hub — optimize-audio