ue-graph-capture

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses uvx (a Python package runner) to execute the ue-graph-capture tool. It also references npx for managing rule files via compose-agentsmd. These commands are central to the skill's documented purpose.
  • [EXTERNAL_DOWNLOADS]: The skill leverages uvx and npx to fetch and run packages (ue-graph-capture and compose-agentsmd) from public registries. The packages are vendor-owned and used with specific version pinning (0.1.0) in the capture workflow.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface as it processes external Unreal Engine project files and assets.
  • Ingestion points: Reads .uproject files and asset paths (e.g., /Game/...) as described in SKILL.md and README.md.
  • Boundary markers: The instructions explicitly state to fail with diagnostics if the project, asset, or graph is invalid.
  • Capability inventory: Executes shell commands via uvx and writes image files to the output path.
  • Sanitization: Relies on the external CLI tool for parsing binary assets and mandates validation of the resulting PNG file.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 02:36 AM