ue5-network-viz

Warn

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill frequently utilizes the execute_tool_script capability of the Unreal Engine MCP server to run dynamically generated Python code.
  • Evidence: This pattern is implemented in actors.py, camera.py, hierarchy.py, and panels.py to handle batch actor spawning, camera movements, and UI rendering.
  • Context: The code generation is used to mitigate performance issues and host instability by reducing the number of JSON-RPC round-trips to the engine.
  • Sanitization: The skill uses double-JSON encoding (e.g., in actors.py and panels.py) to safely embed data into the generated script strings, which is a defensive measure against script injection.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes network topology, metrics, and incident data from external sources which are then used in the 3D visualization and script generation.
  • Ingestion points: renderer.py and telemetry.py receive data from sources like pyATS, SuzieQ, CML, and SNMP traps.
  • Boundary markers: None explicitly present to separate untrusted data from the agent's internal instructions.
  • Capability inventory: The skill possesses extensive control over the Unreal Engine environment, including actor spawning, property manipulation, and script execution.
  • Sanitization: Basic character replacement is performed on hostnames in actors.py to ensure they are safe for use as actor names.
  • [EXTERNAL_DOWNLOADS]: The documentation references official software downloads.
  • Evidence: SKILL.md directs users to unrealengine.com for the Unreal Engine software.
  • Note: This is a neutral reference to a well-known service for necessary prerequisites.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 30, 2026, 04:29 PM
Security Audit — agent-trust-hub — ue5-network-viz