unreal-cinematics

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The toolkit in scripts/ue_cine.py utilizes subprocess.run() to invoke external binaries including ffmpeg for video processing and the Unreal Editor executable for command-line rendering. The commands are built using paths and arguments derived from the project plan (e.g., uproject and map_path), which is a standard but sensitive operation.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external JSON project plans. These files contain fields such as asset names, character properties, and render settings that are interpolated into prompt-like structures for the agent and parameters for shell commands. This creates a surface for indirect injection where malicious instructions could be embedded in configuration metadata.
  • [DYNAMIC_EXECUTION]: The skill leverages the unreal Python API to dynamically manipulate objects and execute logic within the Unreal Engine editor session. This includes programmatically creating level sequences, configuring Cine Cameras, and managing render jobs at runtime, which is standard for engine automation but involves the execution of generated logic based on input plans.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 07:22 AM