ClawHub
Back to skill

Security audit

Unity CI Kit

Security checks for vulnerabilities and agentic risk

Overview

This Unity CI skill matches its stated purpose, but its bundled runner has unsafe command and file-path handling that users should review before installing.

Use this only with trusted Unity repositories and review ci_config.json before running it, especially on Windows. Prefer patching the runner to use argument-list subprocess calls with shell=False and constrain log/result paths to the project before using it in CI.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ci_agent.py:192
Finding

Windows Command Injection Through Repository-Controlled CI Configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ci_agent.py:180
Finding

Arbitrary File Overwrite Through Unrestricted Result File Path

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill instructs users to run a Python CLI, copy files into a project, and invoke Unity batchmode builds, which clearly implies shell execution plus file read/write capability. Because the skill does not declare any tool scope or allowed-tools restrictions, an agent may execute these operations with broader privileges than intended, increasing the risk of unintended command execution or filesystem modification in an automated environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module docstring presents the skill description, applicability, and usage primarily in Chinese, and similar Chinese-only user-facing text appears throughout the CLI. For a general-purpose CI tool described as applicable across platforms and Unity versions, this imposes a specific language without user opt-in or justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ci_agent.py (reported line 104)May include surrounding context.

python
# 3. fallback: 试试不带版本的 Unity 命令
    for cmd in ["Unity", "unity"]:
        try:
            result = subprocess.run([cmd, "-version"], capture_output=True, text=True, timeout=10)
            if result.returncode == 0:
                return cmd
        except:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

The build/compile commands are constructed as a single shell command string using values from ci_config.json and runtime environment, then executed with shell=True on Windows. This enables command injection if an attacker can influence fields such as unity_path, execute_method, log_file, or the working directory context, because shell metacharacters can be interpreted by cmd.exe.

Content

Scanner excerpt · scripts/ci_agent.py (reported line 120)May include surrounding context.

python
def run_command(cmd, timeout=600):
    """运行命令，返回 (success, stdout)"""
    try:
        result = subprocess.run(
            cmd, capture_output=True, text=True, timeout=timeout,
            cwd=os.getcwd(), shell=(platform.system() == "Windows")
        )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The USAGE text shown to users is Chinese-only even though the tool is a cross-platform CLI intended for broad use. Because the file does not offer a language choice or explain a region-specific requirement, this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file includes a code example that calls AssetDatabase.SaveAssets() and later instructs users to run python ci_agent.py build, both of which can change project state. The guide does not include any user-facing warning that these operations may write or persist changes to project files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

Lines L200-L202 state that the code ensures the Unity Editor is closed to avoid conflicts, yet the implementation is only a no-op pass. This is an active contradiction between inline intent documentation and actual behavior, not merely an omitted detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file's user-facing comments and usage instructions are written entirely in Chinese, including setup and operational guidance. This imposes a specific language choice without offering an alternative or indicating that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The comment text is written entirely in Chinese ('Unity CI Agent 配置文件 — 按项目自定义'), which imposes a specific language in a user-facing configuration context without indicating any language choice or locale-specific justification. This matches the policy category for language or locale constraints lacking user opt-in.

Content

No source excerpt is available for this finding.