Import it into a scratch project first, read the import list before you accept it, check the signature status if your editor is Unity 6.6 or later, and only then bring it into the real project. Record the source and version. The steps below take about fifteen minutes per asset.
What a .unitypackage is
A .unitypackage is an asset package exported from Unity, used to share assets and scripts between projects, often through the Asset Store or direct download. Importing it copies files into your Assets folder, including any scripts and plugins inside.
Unity's signature documentation says that starting with Unity 6.6, signature checks extend to asset packages exported and imported as local files. The page describes no such check for local asset packages on earlier editors, so on older editors your own review is the only check.
Steps
- Use a scratch project. Create an empty project on the same editor version. Never import an unknown package into a project that holds your game.
- Download from the official source. Prefer the Asset Store or the publisher's own site. Record the URL and the file name.
- Read the import dialog. Unity shows a list of files with checkboxes before importing. Look for folders named Editor, a Plugins folder, and any file types you did not expect, such as executables or shell scripts.
- Check the signature. On Unity 6.6 or later, the Package Manager window shows the status of a package's signature and flags problems. Unity recommends using only signed packages and removing ones with an invalid signature. See what each status means.
- Import, but do not open scenes yet. Look at the Console for errors and warnings.
- Sort the code. Use the editor versus runtime routine to list what runs at authoring time and what ships.
- Run a build of the scratch project and watch for network calls if the asset claims to be offline.
- Decide and record. If you adopt it, copy only the folders you need into the real project, and add an entry to your plugin register.
What to look for in the file list
| Red flag | Why |
|---|---|
| Executables, scripts or installers inside the package | Unusual for an asset and rarely needed |
| Large binaries in Plugins with no source and no documentation | Unreadable code with unknown behavior |
| Editor scripts that run on load | They execute on developer machines |
| Files with misleading extensions | Often a sign of careless packaging at best |
| No license file | You may not be allowed to ship it |
After you adopt it
Treat the asset like any dependency. Name an owner, note where updates come from, and check that source on a schedule. Our guide on who owns plugin and asset pack updates helps decide who that is.
Why a scratch project
Importing runs editor code, and opening a project can trigger scripts. Doing the first look somewhere with no credentials, no source and no build keys keeps a mistake cheap.
Safeguard's SBOM and dependency scanning covers packages and libraries your repositories declare, and you can try a free scan at gold.safeguard.sh/scan. The scratch import above is the manual step that comes first.
Quick check
Does Unity check signatures on every .unitypackage?
Per Unity's documentation, local asset package checks start with Unity 6.6. Older editors do not show them.
Is the Asset Store enough of a guarantee?
Unity lists Asset Store packages among those it checks for signatures, but a signature speaks to origin and integrity, not to the quality of the code. Still review.
Why not just import and look afterwards?
Importing can place editor scripts in your project, and those may run when the editor reloads code.
Sources
Last reviewed: 19 October 2026.
