unreal-pipeline-automation

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to interact with environment utilities (e.g., pgrep for process checking), source control systems (Perforce p4), and Unreal Engine's own build tools (UnrealEditor-Cmd, RunUAT.sh). These operations are essential and expected for the skill's stated purpose of pipeline and build automation.
  • [DYNAMIC_EXECUTION]: The ue_pipeline.py script employs a helper function _lead that uses __import__ to dynamically load optional modules (such as ue_env, ue_run, ue_audit, and ue_review) from a sibling toolkit directory. This dynamic loading is used for internal code modularity and relies on locally available files within the agent's environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including mesh files (FBX, USD, OBJ, glTF) and JSON metadata sidecars, to drive its automated import and processing logic. This ingestion surface is managed through structural validation and naming convention checks, significantly mitigating the risk of accidental or adversarial influence on the pipeline.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 07:22 AM