{"data":{"skill":{"slug":"dirtybitgames-unity-editor","name":"unity-editor","icon":"📦","repo":"https://github.com/DirtybitGames/unityctl/tree/main/examples/unity-editor","status":"approved","author":"DirtybitGames","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"4e2084a6-9060-4336-a12b-59c40f1eccc4","skill_id":"56f12a70-c0aa-4c3a-8887-cf7badaabd37","version":7,"content_hash":"921237bdaecdd31924de189be9d0f670","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All static Ruby or shell backtick alerts are false positives from Markdown inline code and fenced examples, not executable Ruby code. The screen capture blocker is also a false positive because the file only documents a local unityctl screenshot command and no upload behavior. A separate semantic risk remains: the skill instructs assistants to execute arbitrary C# in the Unity Editor via Roslyn.","remediation":[{"issue":"Arbitrary C# execution in the Unity Editor","severity":"high","suggestion":"Require explicit user confirmation before unityctl script execution and summarize the intended effects before running generated scripts."},{"issue":"Screen capture can expose project or editor state","severity":"medium","suggestion":"Run screenshot capture only after a clear user request and avoid capturing unrelated sensitive editor windows."},{"issue":"External unityctl commands change local editor state","severity":"medium","suggestion":"Keep commands visible to the user and avoid passing untrusted text into command arguments without validation."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":14,"line_start":14},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":23,"line_start":21},{"file":"SKILL.md","line_end":30,"line_start":23},{"file":"SKILL.md","line_end":34,"line_start":30},{"file":"SKILL.md","line_end":37,"line_start":34},{"file":"SKILL.md","line_end":40,"line_start":37},{"file":"SKILL.md","line_end":43,"line_start":40},{"file":"SKILL.md","line_end":46,"line_start":43},{"file":"SKILL.md","line_end":49,"line_start":46},{"file":"SKILL.md","line_end":54,"line_start":49},{"file":"SKILL.md","line_end":57,"line_start":54},{"file":"SKILL.md","line_end":60,"line_start":57},{"file":"SKILL.md","line_end":63,"line_start":60},{"file":"SKILL.md","line_end":66,"line_start":63},{"file":"SKILL.md","line_end":69,"line_start":66},{"file":"SKILL.md","line_end":71,"line_start":69},{"file":"SKILL.md","line_end":77,"line_start":71},{"file":"SKILL.md","line_end":88,"line_start":77},{"file":"SKILL.md","line_end":90,"line_start":88},{"file":"SKILL.md","line_end":92,"line_start":90},{"file":"SKILL.md","line_end":94,"line_start":92},{"file":"SKILL.md","line_end":95,"line_start":94},{"file":"SKILL.md","line_end":97,"line_start":95},{"file":"SKILL.md","line_end":99,"line_start":97},{"file":"SKILL.md","line_end":103,"line_start":99},{"file":"SKILL.md","line_end":106,"line_start":103},{"file":"SKILL.md","line_end":111,"line_start":106},{"file":"SKILL.md","line_end":117,"line_start":111},{"file":"SKILL.md","line_end":120,"line_start":117},{"file":"SKILL.md","line_end":131,"line_start":120},{"file":"SKILL.md","line_end":132,"line_start":131},{"file":"SKILL.md","line_end":134,"line_start":132},{"file":"SKILL.md","line_end":137,"line_start":134},{"file":"SKILL.md","line_end":149,"line_start":137},{"file":"SKILL.md","line_end":150,"line_start":149},{"file":"SKILL.md","line_end":152,"line_start":150},{"file":"SKILL.md","line_end":155,"line_start":152},{"file":"SKILL.md","line_end":167,"line_start":155},{"file":"SKILL.md","line_end":168,"line_start":167},{"file":"SKILL.md","line_end":170,"line_start":168},{"file":"SKILL.md","line_end":174,"line_start":170},{"file":"SKILL.md","line_end":175,"line_start":174},{"file":"SKILL.md","line_end":176,"line_start":175},{"file":"SKILL.md","line_end":176,"line_start":176},{"file":"SKILL.md","line_end":184,"line_start":180},{"file":"SKILL.md","line_end":184,"line_start":184},{"file":"SKILL.md","line_end":188,"line_start":187}]}],"critical_findings":[],"high_findings":[{"title":"Screen capture upload","locations":[{"file":"SKILL.md","line_end":70,"line_start":70}],"confidence":1,"description":"unityctl screenshot capture          # Capture screenshot","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."},{"title":"Arbitrary C# Execution in Unity Editor","locations":[{"file":"SKILL.md","line_end":99,"line_start":73}],"confidence":0.96,"description":"The skill tells the assistant to execute arbitrary C# in the running editor via Roslyn and shows direct command execution with a -c argument. This can run code with the user's Unity Editor privileges and can modify projects or access local resources without careful approval.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"Lines 73-99 explicitly describe arbitrary C# execution and include the unityctl script execute command. This is intended functionality, so the risk is certain even though it is useful for debugging."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[{"title":"Screen capture upload","locations":[{"file":"SKILL.md","line_end":70,"line_start":70}],"confidence":1,"description":"unityctl screenshot capture          # Capture screenshot","review_kind":"false_positive","source_category":"blocker","source_severity":"high","confidence_reasoning":"Force-confirmed blocker/high static finding; AI dismissal overridden."}],"files_scanned":1,"total_lines":189,"audit_model":"codex","audited_at":"2026-07-05T12:57:38.639+00:00","created_at":"2026-07-05T14:33:33.192607+00:00","static_findings":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Start the bridge daemon: `unityctl bridge start`","category":"external_commands","line_end":13,"severity":"medium","line_start":13},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Launch Unity: `unityctl editor run` or manually open the project in Unity Editor","category":"external_commands","line_end":14,"severity":"medium","line_start":14},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Verify connection: `unityctl status`","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":23,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":30,"severity":"medium","line_start":23},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":34,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":37,"severity":"medium","line_start":34},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":40,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":43,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":46,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":49,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":54,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":57,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":60,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":63,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":66,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":69,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":71,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":77,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```cs","category":"external_commands","line_end":88,"severity":"medium","line_start":77},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":90,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":92,"severity":"medium","line_start":90},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":94,"severity":"medium","line_start":92},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"You can also execute code directly with `-c`:","category":"external_commands","line_end":95,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":97,"severity":"medium","line_start":95},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":99,"severity":"medium","line_start":97},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Scripts must define a class with a `public static object Main()` method. The return value is JSON-se","category":"external_commands","line_end":103,"severity":"medium","line_start":99},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":106,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":111,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":117,"severity":"medium","line_start":111},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":120,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```cs","category":"external_commands","line_end":131,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":132,"severity":"medium","line_start":131},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":134,"severity":"medium","line_start":132},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":137,"severity":"medium","line_start":134},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```cs","category":"external_commands","line_end":149,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":150,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":152,"severity":"medium","line_start":150},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":155,"severity":"medium","line_start":152},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```cs","category":"external_commands","line_end":167,"severity":"medium","line_start":155},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":168,"severity":"medium","line_start":167},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":170,"severity":"medium","line_start":168},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":174,"severity":"medium","line_start":170},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Run `unityctl status` to check overall project status before running commands","category":"external_commands","line_end":175,"severity":"medium","line_start":174},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Always run `unityctl asset refresh` after modifying C# files before entering play mode","category":"external_commands","line_end":176,"severity":"medium","line_start":175},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For script execution, write scripts to `tmp/<scriptname>.cs` and execute with `-f`","category":"external_commands","line_end":176,"severity":"medium","line_start":176},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Run `unityctl status` first to diagnose issues.","category":"external_commands","line_end":184,"severity":"medium","line_start":180},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Bridge not responding | `unityctl bridge stop` then `unityctl bridge start` |","category":"external_commands","line_end":184,"severity":"medium","line_start":184},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| \"Project not found\" | Run from project directory or use `--project` flag |","category":"external_commands","line_end":188,"severity":"medium","line_start":187},{"id":"blocker:SKILL.md:70:screen-capture-upload","file":"SKILL.md","pattern":"Screen capture upload","snippet":"unityctl screenshot capture          # Capture screenshot","category":"blocker","line_end":70,"severity":"high","line_start":70}],"finding_verdicts":[{"id":"external_commands:SKILL.md:13:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:14:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:23:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:34:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:77:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:90:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:92:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:95:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:97:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:99:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:111:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:131:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:132:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:134:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:150:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:152:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:155:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:167:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:168:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:170:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:174:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:175:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:176:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:180:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:184:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"external_commands:SKILL.md:187:ruby-shell-backtick-execution","reason":"The matched backticks are Markdown formatting or fenced examples in SKILL.md, not Ruby backtick execution in runnable code. Any actual unityctl usage is documented for user-visible Unity control, with C# execution risk captured separately as a semantic finding.","verdict":"false_positive","confidence":0.95},{"id":"blocker:SKILL.md:70:screen-capture-upload","reason":"The line documents a local unityctl screenshot capture command. I found no upload, network transfer, or covert capture behavior in SKILL.md.","verdict":"false_positive","confidence":0.94}],"semantic_findings":[{"title":"Arbitrary C# Execution in Unity Editor","severity":"high","locations":[{"file":"SKILL.md","line_end":99,"line_start":73}],"confidence":0.96,"description":"The skill tells the assistant to execute arbitrary C# in the running editor via Roslyn and shows direct command execution with a -c argument. This can run code with the user's Unity Editor privileges and can modify projects or access local resources without careful approval.","confidence_reasoning":"Lines 73-99 explicitly describe arbitrary C# execution and include the unityctl script execute command. This is intended functionality, so the risk is certain even though it is useful for debugging."}],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"confirmed_risk_level does not match the canonical trust resolver"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}