unreal-pipeline-automation
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto interact with environment utilities (e.g.,pgrepfor process checking), source control systems (Perforcep4), and Unreal Engine's own build tools (UnrealEditor-Cmd,RunUAT.sh). These operations are essential and expected for the skill's stated purpose of pipeline and build automation. - [DYNAMIC_EXECUTION]: The
ue_pipeline.pyscript employs a helper function_leadthat uses__import__to dynamically load optional modules (such asue_env,ue_run,ue_audit, andue_review) from a sibling toolkit directory. This dynamic loading is used for internal code modularity and relies on locally available files within the agent's environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including mesh files (FBX, USD, OBJ, glTF) and JSON metadata sidecars, to drive its automated import and processing logic. This ingestion surface is managed through structural validation and naming convention checks, significantly mitigating the risk of accidental or adversarial influence on the pipeline.
Audit Metadata