ue-graph-capture
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
uvx(a Python package runner) to execute theue-graph-capturetool. It also referencesnpxfor managing rule files viacompose-agentsmd. These commands are central to the skill's documented purpose. - [EXTERNAL_DOWNLOADS]: The skill leverages
uvxandnpxto fetch and run packages (ue-graph-captureandcompose-agentsmd) from public registries. The packages are vendor-owned and used with specific version pinning (0.1.0) in the capture workflow. - [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface as it processes external Unreal Engine project files and assets.
- Ingestion points: Reads
.uprojectfiles and asset paths (e.g.,/Game/...) as described inSKILL.mdandREADME.md. - Boundary markers: The instructions explicitly state to fail with diagnostics if the project, asset, or graph is invalid.
- Capability inventory: Executes shell commands via
uvxand writes image files to the output path. - Sanitization: Relies on the external CLI tool for parsing binary assets and mandates validation of the resulting PNG file.
Audit Metadata