spacetimedb-client-unreal
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates local shell command execution via the
spacetime generatecommand to create C++ bindings for Unreal Engine projects, as described inSKILL.mdandreferences/clients-unreal.md. This involves the tool reading project files and writing new source files to the local directory.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for the agent to ingest untrusted data from a remote database, which could lead to unauthorized instruction execution if the data contains malicious prompts.\n - Ingestion points: Data from the SpacetimeDB instance enters the agent's context through
URemoteTablecaches (e.g.,Iter(),OnInsert) andURemoteReducersresult delegates (e.g.,OnSendMessage) defined in bothSKILL.mdandreferences/clients-unreal.md.\n - Boundary markers: There are no instructions to use specific delimiters or protective prompts to differentiate between database content and agent instructions.\n
- Capability inventory: The skill includes the capability to execute shell commands and modify the local filesystem through the
spacetimeCLI tool.\n - Sanitization: No sanitization or validation mechanisms are provided for the content retrieved from the database or reducer events.
Audit Metadata