optimize-audio
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill interacts with the Unity Editor by compiling and executing C# snippets at runtime via the
unity command evaltool. These snippets are sourced from templates within theresources/audio-import-api.mdfile and are used to audit and modify audio import settings. This constitutes dynamic code generation and execution as a core functionality. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data such as asset paths and GameObject names from the Unity project environment, as documented in the scene enumeration recipes in
resources/audio-import-api.md. The evidence shows a lack of boundary markers or sanitization for these external inputs. Combined with the skill's capability to execute arbitrary C# code in the Editor (viaeval), this presents a surface for indirect prompt injection if project assets are maliciously named, although the skill includes checkpoints requiring user confirmation before applying changes.
Audit Metadata