unreal-materials
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Unreal Engine projects, including material graph structures, texture metadata, and asset names, which represents a potential indirect prompt injection surface.
- Ingestion points:
audit_textures,export_graph, andcensus_projectinscripts/ue_materials.pyread asset names and properties from the project registry. - Capability inventory: The skill has the ability to create and modify assets, save changes to the filesystem, and execute Unreal Engine console commands.
- Boundary markers: Findings and reports generated from asset data do not use specific delimiters to isolate potentially untrusted asset names.
- Sanitization: Input data is validated for technical correctness according to Unreal Engine standards but is not specifically sanitized for instruction-like patterns.
- [DYNAMIC_EXECUTION]: The skill uses dynamic code generation and execution to programmatically build material graphs and interact with the Unreal Engine editor.
- Node generation:
scripts/ue_materials.pyincludes functions likebuild_kit_surfacethat use theMaterialEditingLibraryto instantiate and link material nodes at runtime. - Remote execution: Procedure
P9inreferences/procedures.mdutilizes theue_remotetoolkit to execute Python commands within a live Unreal Engine editor instance for performance profiling. - Shader injection: Procedure
P13inreferences/procedures.mdgenerates HLSL shader code and injects it intoMaterialExpressionCustomnodes. - [COMMAND_EXECUTION]: The skill invokes Unreal Engine console commands for editor configuration and performance analysis.
- Execution method: The
console()function inscripts/ue_materials.pycallsunreal.SystemLibrary.execute_console_commandto set CVars and trigger engine features likeHighResShotandCsvProfile.
Audit Metadata