unreal-vfx

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data, which creates a potential surface for indirect prompt injection.
  • Ingestion points: The skill ingests data from external sources including .png image captures and .jsonl performance trace files via procedures such as V.capture_ages and ue_stat.parse_jsonl in scripts/ue_vfx.py.
  • Boundary markers: The skill implements ue_review.image_checks to perform basic validation of captured frame content (detecting all-white or all-black frames), though it lacks explicit delimiters for processing trace data.
  • Capability inventory: Across its scripts, the skill possesses the capability to execute Unreal Engine console commands using u.SystemLibrary.execute_console_command and modify engine asset properties via set_editor_property.
  • Sanitization: Image content validation is present; however, there is no explicit schema validation or sanitization shown for performance trace data ingested during measurement tasks.
  • [EXTERNAL_DOWNLOADS]: The skill references several external resources, primarily targeting trusted organizations and well-known services.
  • Fetches technical specifications and guidelines from official Epic Games documentation and Unreal Engine developer resources.
  • References expert presentations and community tutorials hosted on YouTube.
  • Mentions a community GitHub repository (db-lyon/ue-mcp) in the documentation as a discovery route, though no automated fetching or execution of this resource is performed by the skill's scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 07:22 AM