scenario-unreal-cinematics
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The toolkit in
scripts/ue_cine.pyinvokessubprocess.runto execute local tools likeffmpegandffprobe. While these are standard for EXR processing and movie encoding, the command arguments include file paths and naming patterns derived from user-provided plan data. - [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON project plans and OpenEXR image headers. This ingestion of untrusted data represents an attack surface where malicious metadata could be used to influence the agent's cinematography workflow or manipulate file system operations.
- [DYNAMIC_EXECUTION]: The skill includes code snippets and procedures (in
references/procedures.md) intended for execution within the Unreal Engine Python environment. These scripts have the capability to create assets, modify sequences, and trigger renders based on project plan data.
Audit Metadata