ue5-network-viz

The module is primarily an Unreal Engine editor automation toolkit (spawning actors, loading meshes, creating material instances, applying colors/tags). The main security risk is the dynamic generation and execution of an editor-side Python script via TOOL_EXECUTE_SCRIPT, with interpolated fields such as actor_label and structured payload driving the executed logic. If any upstream caller can supply malicious strings/values that reach the script templating without robust escaping/validation, an attacker could inject behavior into the UE editor environment, potentially altering projects and triggering save/screenshot actions. No explicit credential theft or network exfiltration is evident in this fragment.

No overt data theft, credential stealing, or external network communication is present in this module. However, it intentionally constructs and sends dynamically generated Python code to a privileged Unreal Engine environment via TOOL_EXECUTE_SCRIPT, and it interpolates hostname-derived actor_name directly into that executable script without visible escaping/validation. This creates a meaningful code-injection/supply-chain security risk in the connected UE runtime (the module acts as an RCE enabler if upstream inputs or the UE tool boundary are not strictly controlled/sandboxed).

No direct indicators of classic malware (exfiltration, credential theft, persistence) are present in this fragment. The dominant security concern is architectural: the module dynamically generates a Python script and triggers TOOL_EXECUTE_SCRIPT to execute it in a Unreal editor/game context, combined with scene-modifying destroy/spawn behavior. If caller-controlled inputs or the tool authorization pathway are not strictly controlled, this can be abused for sabotage (unintended actor destruction) or broader impact via the execution channel. Review strict permissions/allowlists for TOOL_EXECUTE_SCRIPT and validate/limit what input content can influence the generated script.