unreal-technical-artist
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context injection placeholder (
!) inSKILL.mdto load content from internal project files, such asskills/_shared/protocols/ux-protocol.mdand.production-grade.yaml, when the skill is loaded. These commands are limited to local file system read operations for documentation purposes and do not involve unauthorized data access or network communication. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from multiple external protocol files, which could theoretically serve as an injection vector if the files were compromised. Ingestion points: The skill reads markdown and YAML files from the
skills/_shared/directory and the root directory. Boundary markers: The dynamically loaded content is included without explicit markers or 'ignore' instructions. Capability inventory: The skill contains C++ and Python templates for Unreal Engine automation but lacks tools for network exfiltration or direct file modification based on the ingested data. Sanitization: The skill relies on the integrity of the local project files and does not perform additional content validation.
Audit Metadata