ue-metahuman-live-link
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface by ingesting untrusted real-time animation data from external sources into the agent context.
- Ingestion points: Real-time performance data is ingested from webcams, microphones, and the Live Link Face iOS application via TCP/UDP network protocols as described in
SKILL.mdandreferences/live-link-sources.md. - Boundary markers: None are present; the skill processes binary facial animation curve data without explicit delimiters or warnings regarding embedded instructions.
- Capability inventory: The skill facilitates writing recorded data to the local file system using
UTakeRecorder(documented inreferences/recording-and-runtime.md) and establishes network connections for data streaming usingLiveLinkFaceSource(documented inSKILL.md). - Sanitization: No sanitization or validation of the incoming animation data stream is described before the data is processed by Unreal Engine's Animation Blueprints and RigLogic systems.
Audit Metadata