cli-anything-unrealinsights
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of Unreal Engine editor binaries (e.g., UnrealEditor.exe) and build scripts (Build.bat) based on user-defined engine and project paths. Specifically, commands like 'capture run' and 'backend ensure-insights' trigger process creation using paths that may not be verified.
- [DYNAMIC_EXECUTION]: The skill uses the 'UNREALINSIGHTS_LIVE_EXEC' environment variable as a template for shell commands. This mechanism allows the tool to dynamically assemble and execute commands for live process control by interpolating process IDs and task-specific arguments into the user-defined template.
- [INDIRECT_PROMPT_INJECTION]: The skill processes and summarizes information from external Unreal Engine trace files (.utrace). This creates a vulnerability where malicious data embedded in a trace (such as manipulated counter or thread names) could attempt to influence the agent's behavior during summary generation. (1) Ingestion points: Trace files and stores accessed via 'analyze summary' and 'export' commands. (2) Boundary markers: No explicit markers are mentioned to isolate trace summaries from the agent's instructions. (3) Capability inventory: Binary execution, build script invocation, and file system operations. (4) Sanitization: The skill does not describe any methods for sanitizing trace data before it is presented to the agent.
Audit Metadata