umg-widgets

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill provides structured documentation and script examples for Unreal Engine UI development. All identified operations (asset creation, property modification, hierarchy management) are performed using standard Unreal Engine Python APIs (the unreal module) and are confined to the project's asset environment.
  • [COMMAND_EXECUTION]: The skill facilitates the execution of Python scripts within the Unreal Engine environment to perform asset management and UI construction. These scripts are provided as templates within the skill and use legitimate engine automation APIs to modify assets in a development context.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing data from Unreal Engine assets (Widget Blueprints and ViewModels) through functions like get_widget_snapshot and get_live_property. While this represents an ingestion point for untrusted data if an asset were maliciously crafted, the risk is mitigated as the skill contains no autonomous decision-making logic that executes instructions found within that data.
  • Ingestion points: WidgetService.get_widget_snapshot (SKILL.md, scripts/inspect_hierarchy.txt), WidgetService.get_live_property (scripts/pie_inspect.txt).
  • Boundary markers: Not explicitly defined for property values.
  • Capability inventory: execute_python_code, EditorAssetLibrary.delete_asset, WidgetService.bind_event.
  • Sanitization: Standard Unreal Engine type-checking and property validation are assumed via the unreal module.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 09:40 AM