{"data":{"skill":{"slug":"unity-technologies-ui","name":"ui","icon":"📦","repo":"https://github.com/unity-technologies/skills/tree/9d282100540601cfddc4bbd69f36a239d7a6f55c/skills/ui","status":"approved","author":"unity-technologies","authorVersion":null,"skillstoreRevision":1},"audit":{"id":"3325f5a0-c474-410d-88e6-26c9067188ea","skill_id":"e0d212b0-b747-4ac8-8c4f-13b3ad3624d7","version":1,"content_hash":"v3:e406bf64b5db6e514879399e87b346fa7ff7c2fb:5dbdf432ca8beebf90a9bd2ce22958aac9b2622984f52292ebcccacb383e537b:35f3b465f329ad3ebc5a92dad573801d66bb7d88b607bdab25a4482b262fdaf4:736b696c6c732f756e6974792d746563686e6f6c6f676965732f7569:7eb484d7e0a5f3080c46cc2524c9e5d4","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 24 static findings are false positives: 22 match Markdown code formatting, and two match ordinary UI descriptions. No evidence found of command execution, system reconnaissance, data exfiltration, or prompt injection in the reviewed SKILL.md. Referenced specialized skills are not included, so their behavior is outside this audit.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":28,"line_start":28},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":35,"line_start":35},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":48,"line_start":48},{"file":"SKILL.md","line_end":49,"line_start":49},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":51,"line_start":51},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":58,"line_start":58},{"file":"SKILL.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":130,"line_start":130},{"file":"SKILL.md","line_end":141,"line_start":141}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":143,"audit_model":"codex","audited_at":"2026-10-10T14:09:56.88+00:00","created_at":"2026-10-11T03:32:44.213586+00:00","static_findings":[{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `.uxml` or `.uss` files (including in `/Editor/`) | `ui-uitk` |","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| \"UI Toolkit\", \"UITK\", \"UIElements\", \"CreateGUI\" | `ui-uitk` |","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Canvas prefabs/objects, `.prefab` with UI | `ui-ugui` |","category":"external_commands","line_end":28,"severity":"medium","line_start":28},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| \"uGUI\", \"Canvas\", \"RectTransform\", \"legacy UI\" | `ui-ugui` |","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| \"IMGUI\", \"OnGUI\", \"OnInspectorGUI\", \"immediate mode\" | `ui-imgui` |","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Figma URL (`figma.com/design/...`), \"Figma\", \"import from Figma\" | Not available — see below |","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If no existing pattern is detected, default to `ui-uitk` for new editor UI","category":"external_commands","line_end":35,"severity":"medium","line_start":35},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Only use `ui-imgui` if project exclusively uses IMGUI or user explicitly requests it","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `.uxml` or `.uss` files (including in `/Editor/`) | UI Toolkit (runtime or editor) |","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `UIDocument` components in scenes | UI Toolkit (runtime) |","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Editor scripts with `CreateGUI()` method | UI Toolkit (editor) |","category":"external_commands","line_end":48,"severity":"medium","line_start":48},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `Canvas` in scenes/prefabs | uGUI |","category":"external_commands","line_end":49,"severity":"medium","line_start":49},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| `RectTransform` heavy usage | uGUI |","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Editor scripts with `OnGUI()` or `OnInspectorGUI()` | IMGUI (legacy editor) |","category":"external_commands","line_end":51,"severity":"medium","line_start":51},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- For new runtime/game UI where the user has no preference: default to uGUI (`ui-ugui`)","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- When the user mentions mobile/performance constraints or older Unity versions (pre-6.0): bias towa","category":"external_commands","line_end":58,"severity":"medium","line_start":58},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### UI Toolkit — `ui-uitk`","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Understands**, **edits**, and **generates** `.uxml` and `.uss` files","category":"external_commands","line_end":76,"severity":"medium","line_start":76},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### uGUI — `ui-ugui`","category":"external_commands","line_end":80,"severity":"medium","line_start":80},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### IMGUI — `ui-imgui`","category":"external_commands","line_end":86,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **Activate specialized skill** — Route to `ui-uitk`, `ui-ugui`, or `ui-imgui`","category":"external_commands","line_end":130,"severity":"medium","line_start":130},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Check for existing editor `.uxml` files to confirm UITK usage","category":"external_commands","line_end":141,"severity":"medium","line_start":141},{"id":"blocker:SKILL.md:66:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| **Understanding** | \"What does this button do?\", \"How is this laid out?\", \"Explain this UI\" |","category":"blocker","line_end":66,"severity":"low","line_start":66},{"id":"blocker:SKILL.md:113:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- \"working UI\" → valid UI that renders","category":"blocker","line_end":113,"severity":"low","line_start":113}],"finding_verdicts":[{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"Line 26 formats file extensions, an editor directory, and a skill name as Markdown code in a routing table. No shell execution appears.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"Line 27 maps UI Toolkit keywords to the Markdown-formatted ui-uitk skill name. This is routing documentation, not a shell command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:28:ruby-shell-backtick-execution","reason":"Line 28 uses Markdown backticks for the prefab extension and ui-ugui skill name. The table describes UI routing without executing commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"Line 29 associates Canvas and RectTransform keywords with the Markdown-formatted ui-ugui identifier. No executable shell syntax or invocation is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Line 30 maps IMGUI keywords to the ui-imgui skill identifier using Markdown formatting. It does not invoke Ruby or a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Line 31 formats an example Figma URL as Markdown code and marks that route unavailable. It neither executes commands nor requests network access.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:35:ruby-shell-backtick-execution","reason":"Line 35 formats ui-uitk as a skill identifier in an editor UI recommendation. This is framework selection prose, not command execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"Line 36 formats ui-imgui as a skill identifier and restricts when it should be selected. The backticks are Markdown, not executable syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"Line 46 formats file extensions and an editor directory in a framework identification table. It describes project artifacts without shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"Line 47 formats the Unity UIDocument component name as Markdown code. It is a framework detection clue, not a command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:48:ruby-shell-backtick-execution","reason":"Line 48 names CreateGUI() as an editor framework detection clue using Markdown formatting. The method is not called by executable code.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:49:ruby-shell-backtick-execution","reason":"Line 49 formats Canvas as a Unity component identifier in a project detection table. No external command is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"Line 50 formats RectTransform as a Unity component identifier associated with uGUI. This is explanatory Markdown, not shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:51:ruby-shell-backtick-execution","reason":"Line 51 lists OnGUI() and OnInspectorGUI() as IMGUI detection clues in Markdown. These method names are not executed.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"Line 57 formats ui-ugui as the default skill for new runtime UI. The prose selects a framework without invoking a shell.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:58:ruby-shell-backtick-execution","reason":"Line 58 formats ui-ugui as a recommendation for mobile constraints or older Unity versions. No command execution appears in the full line.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"Line 74 is a section heading containing the Markdown-formatted ui-uitk skill name. A heading does not execute commands.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:76:ruby-shell-backtick-execution","reason":"Line 76 uses Markdown backticks for UXML and USS file extensions when describing a specialized skill. No shell or Ruby code is present.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:80:ruby-shell-backtick-execution","reason":"Line 80 is a uGUI section heading with a Markdown-formatted skill identifier. The backticks are presentation markup, not execution syntax.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"Line 86 is an IMGUI section heading with the ui-imgui skill name in Markdown code formatting. It contains no executable command.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:130:ruby-shell-backtick-execution","reason":"Line 130 names three specialized skills in a routing workflow using Markdown backticks. Skill selection is not Ruby or shell execution.","verdict":"false_positive","confidence":1},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"Line 141 formats the UXML extension while requesting a project-local framework check. The backticks do not contain a shell command.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:66:system-reconnaissance","reason":"Line 66 lists example questions about UI buttons and layouts. These questions concern interface understanding, not host reconnaissance or sensitive system information.","verdict":"false_positive","confidence":1},{"id":"blocker:SKILL.md:113:system-reconnaissance","reason":"Line 113 defines working UI as a valid rendered interface within scope guidance. It requests no host enumeration or system information.","verdict":"false_positive","confidence":1}],"semantic_findings":[],"subject_marketplace_commit_sha":"e406bf64b5db6e514879399e87b346fa7ff7c2fb","subject_content_hash":"5dbdf432ca8beebf90a9bd2ce22958aac9b2622984f52292ebcccacb383e537b","subject_tree_hash":"35f3b465f329ad3ebc5a92dad573801d66bb7d88b607bdab25a4482b262fdaf4","subject_plugin_path":"skills/unity-technologies/ui","audit_payload_hash":"7eb484d7e0a5f3080c46cc2524c9e5d4","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"e406bf64b5db6e514879399e87b346fa7ff7c2fb","contentHash":"5dbdf432ca8beebf90a9bd2ce22958aac9b2622984f52292ebcccacb383e537b","treeHash":"35f3b465f329ad3ebc5a92dad573801d66bb7d88b607bdab25a4482b262fdaf4","pluginPath":"skills/unity-technologies/ui","auditPayloadHash":"7eb484d7e0a5f3080c46cc2524c9e5d4"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/unity-technologies-ui/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}