ue-gameplay-abilities
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest project-specific data from a local file, which could contain untrusted instructions if the project environment is compromised.
- Ingestion points: The agent is directed to read
.agents/ue-project-context.mdinSKILL.mdto understand module names, conventions, and enabled plugins. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are provided for the content read from the context file.
- Capability inventory: The skill is strictly informational and contains C++ code templates; it does not include any scripts that perform network operations, file system modifications, or shell command execution.
- Sanitization: There is no evidence of sanitization or validation logic applied to the context file's contents before they are integrated into the agent's reasoning.
Audit Metadata