The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides configuration instructions to download and execute code from external sources using npx -y @runreal/unreal-mcp and uv run unreal_mcp_server.py. The use of npx -y automatically accepts execution of the package, which is sourced from an untrusted registry/repository.\n- [EXTERNAL_DOWNLOADS]: The skill points to external GitHub repositories (github.com/runreal/unreal-mcp and github.com/chongdashu/unreal-mcp) for necessary components. These sources are not recognized as trusted organizations or well-known services.\n- [COMMAND_EXECUTION]: The skill exposes high-privilege tools such as editor_run_python and editor_console_command. These tools enable the execution of arbitrary Python scripts and engine console commands within the Unreal Editor, which can perform significant modifications to the local environment and project files.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a defined attack surface for indirect prompt injection. It ingests untrusted data from user prompts and processes it through powerful tools like editor_run_python without implemented boundary markers or sanitization logic. Ingestion points include the tool arguments and script templates described in SKILL.md and skill-report.json. The capability inventory includes arbitrary code execution and file system writes.\n- [METADATA_POISONING]: The skill-report.json file contains self-referential safety claims, asserting that the skill is safe and dismissing previous security findings as false positives. This attempts to influence the security assessment of the skill.

unreal-engine-developer