unreal-vfx
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data, which creates a potential surface for indirect prompt injection.
- Ingestion points: The skill ingests data from external sources including .png image captures and .jsonl performance trace files via procedures such as
V.capture_agesandue_stat.parse_jsonlinscripts/ue_vfx.py. - Boundary markers: The skill implements
ue_review.image_checksto perform basic validation of captured frame content (detecting all-white or all-black frames), though it lacks explicit delimiters for processing trace data. - Capability inventory: Across its scripts, the skill possesses the capability to execute Unreal Engine console commands using
u.SystemLibrary.execute_console_commandand modify engine asset properties viaset_editor_property. - Sanitization: Image content validation is present; however, there is no explicit schema validation or sanitization shown for performance trace data ingested during measurement tasks.
- [EXTERNAL_DOWNLOADS]: The skill references several external resources, primarily targeting trusted organizations and well-known services.
- Fetches technical specifications and guidelines from official Epic Games documentation and Unreal Engine developer resources.
- References expert presentations and community tutorials hosted on YouTube.
- Mentions a community GitHub repository (
db-lyon/ue-mcp) in the documentation as a discovery route, though no automated fetching or execution of this resource is performed by the skill's scripts.
Audit Metadata