unreal-mcp
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the discovery and loading of 'Agent Skills' from the Unreal project directory via the
AgentSkillToolset.GetSkillstool. These instructions are designed to override the agent's default behavior, creating a potential surface for indirect prompt injection if a project contains malicious instruction files that the agent is directed to follow. - Ingestion points:
AgentSkillToolset.GetSkills(SKILL.md) - Boundary markers: None mentioned; project-specific instructions are explicitly stated to take precedence over defaults (SKILL.md)
- Capability inventory: Extensive capabilities including actor manipulation, Blueprint/Material editing, and C++ compilation via
LiveCodingToolset.CompileLiveCoding(SKILL.md) - Sanitization: No sanitization or validation of the loaded instructions is described.
- [COMMAND_EXECUTION]: The documentation provides instructions for executing local binaries to install a proxy server (
unreal_mcp_proxy.exeorunreal_mcp_proxy) and uses Unreal Editor console commands (ModelContextProtocol.StartServer,ModelContextProtocol.GenerateClientConfig, etc.) to manage the server and client configurations. - [PERSISTENCE]: The skill setup instructions guide the user to enable
bAutoStartServer=Truein theEditorPerProjectUserSettings.inifile. This configuration ensures the MCP server, which provides the agent with control over the Unreal Editor, is automatically launched whenever the project is opened. - [DYNAMIC_EXECUTION]: The skill can invoke the
LiveCodingToolset.CompileLiveCodingtool, which triggers a C++ compilation process within the running Unreal Editor. This allows the agent to dynamically rebuild and execute C++ code changes.
Audit Metadata