game-unreal-specialist
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection vulnerability surface. The skill is designed to orient itself by reading and analyzing untrusted project-level data without security boundaries.
- Ingestion points: Reads contents from the
.uprojectfile,Config/DefaultEngine.ini, and source code within theSource/directory, as well as a specific state file atproduction/session-state/active.md. - Boundary markers: The instructions do not provide explicit delimiters or warnings to treat the content of these files as untrusted data or to ignore embedded instructions.
- Capability inventory: The skill utilizes powerful tools such as
Bash,Write,Edit,Read,Glob, andGrep, which could be exploited if an attacker-controlled file hijacks the agent's context. - Sanitization: No content validation or sanitization of the ingested file data is mentioned in the protocol.
Audit Metadata