The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted 3D data through functions that import FBX files (e.g., import_character and import_animations in scripts/ue_anim.py). While it performs technical skeletal audits, it lacks security-focused sanitization. This ingestion surface, combined with capabilities like modifying project INI files and executing console commands, creates a surface for indirect prompt injection.
Ingestion points: import_character and import_animations in scripts/ue_anim.py process external FBX files.
Boundary markers: None identified; binary data is processed directly without delimiters.
Capability inventory: The skill can write to project configuration files via apply_ini_plan and execute shell-like console commands via console().
Sanitization: Audits focus on skeletal hierarchy and animation performance metrics rather than security sanitization.
[COMMAND_EXECUTION]: The skill executes Unreal Engine console commands through the console() and budget_console() functions. This is a primary capability used for enabling debug views (e.g., a.Budget.Debug.Enabled) and monitoring engine performance (e.g., stat anim). While intended for development workflows, it provides a path for internal command execution within the editor environment.
[DYNAMIC_EXECUTION]: The skill uses dynamic method and property access (via getattr, set_editor_property, and the _call/_get/_set helpers) to handle API variations across different versions of Unreal Engine 5. It also uses ue_run.run_python from a sister skill to execute headless jobs. These techniques are used for legitimate engine compatibility but involve dynamic execution paths.

scenario-unreal-animation