unreal-blueprint-analyzer
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted binary data from Unreal Engine assets, creating a surface for indirect prompt injection where malicious strings could attempt to influence the agent's behavior during analysis.\n
- Ingestion points: The
scripts/extract_uasset_strings.pyscript reads the raw bytes of.uasset,.umap, and other Unreal binary files to identify printable strings.\n - Boundary markers: The
SKILL.mdinstructions require the agent to "Separate confirmed fact from inference" and follow a strict output structure, which serves as a conceptual boundary to maintain objectivity.\n - Capability inventory: The skill is designed for read-only analysis; it does not contain tools or instructions for file system modification, network communication, or execution of arbitrary system-level commands.\n
- Sanitization: The string extraction script utilizes regular expressions to filter for printable ASCII and UTF-16 characters, which isolates text from binary noise but does not perform semantic validation or escaping of the resulting strings.
Audit Metadata