ue5-gamedev
Warn
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
unreal-engine-mcp-serverpackage via npm and references several third-party GitHub repositories (ChiR24/Unreal_mcp, chongdashu/unreal-mcp, appleweed/UnrealMCPBridge, ayeletstudioindia/unreal-analyzer-mcp) as sources for MCP servers. These repositories and their authors are not recognized as trusted vendors. - [DYNAMIC_EXECUTION]: The skill provides instructions and Python code examples for executing arbitrary scripts within the Unreal Engine editor via the Python Editor Script Plugin (port 30010). This includes the use of the
remote_executionmodule to run commands on editor nodes from external processes. - [COMMAND_EXECUTION]: The skill documents the use of the Remote Control API to call
ExecuteConsoleCommand, which allows the agent to execute any Unreal Engine console command on the host machine running the editor. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface by ingesting data from the local project environment and remote API services without safety boundaries.
- Ingestion points: Data is read from the specified
UE5_PROJECT_PATHand received as responses from the Remote Control API and the Bridge orchestrator service. - Boundary markers: No delimiters or safety instructions are provided to the agent to distinguish between project data and its own operational instructions.
- Capability inventory: The skill can perform network operations (HTTP PUT/POST), execute Python code, run engine console commands, and trigger project builds.
- Sanitization: No sanitization or validation logic is defined for processing content retrieved from the file system or remote APIs.
Audit Metadata