spacetimedb-client-unreal

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates local shell command execution via the spacetime generate command to create C++ bindings for Unreal Engine projects, as described in SKILL.md and references/clients-unreal.md. This involves the tool reading project files and writing new source files to the local directory.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for the agent to ingest untrusted data from a remote database, which could lead to unauthorized instruction execution if the data contains malicious prompts.\n
  • Ingestion points: Data from the SpacetimeDB instance enters the agent's context through URemoteTable caches (e.g., Iter(), OnInsert) and URemoteReducers result delegates (e.g., OnSendMessage) defined in both SKILL.md and references/clients-unreal.md.\n
  • Boundary markers: There are no instructions to use specific delimiters or protective prompts to differentiate between database content and agent instructions.\n
  • Capability inventory: The skill includes the capability to execute shell commands and modify the local filesystem through the spacetime CLI tool.\n
  • Sanitization: No sanitization or validation mechanisms are provided for the content retrieved from the database or reducer events.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:23 AM