Is unity-llm-integration safe to install?

SaferSkills independently audited unity-llm-integration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/unity-llm-integration/SKILL.md · 1 file

skills/unity-llm-integration/SKILL.md1.1 KB · Markdown

name: unity-llm-integration

description: >-

Use when adding LLM/chat/RAG features to a Unity game or tool: API keys,

prompt assets, safety, latency, and server-side vs client-side calls.

Unity LLM integration

Discovery

find_ai_related_scripts — label LLM / chat APIs
list_ai_prompt_or_config_assets — JSON/MD with prompt-like keys under Assets
get_ai_stack_summary with include_prompt_assets: true

Security & architecture

Never commit API keys; use environment variables, Unity Cloud Code, or your backend proxy.
Prefer server-mediated LLM calls for shipping titles (rate limits, moderation, cost).
For editor-only tools, ScriptableObject prompts are OK if no secrets are embedded.

UX patterns

Stream responses to UI (TMP) with cancellation tokens.
Cache embeddings locally only when license/privacy allows.
Cap token usage per session for live games.

Audit workflow

find_ai_related_scripts for hardcoded endpoints
search_project with script_pattern: OpenAI or Anthropic
Review list_ai_prompt_or_config_assets for PII in prompts

unity-llm-integration— agent skill

Is unity-llm-integration safe to install?

Unity LLM integration

Discovery

Security & architecture

UX patterns

Audit workflow

Audit the pieces. Scan the whole. Decide.