scenario-unreal-materials
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by ingesting and processing external data including Unreal Engine project configuration files (.ini), engine logs, and binary PNG texture data. Ingestion points are located in
scripts/ue_materials.py(parsing PNG chunks and logs) andreferences/procedures.md(reading configuration files). The skill lacks explicit boundary markers or instructions to the agent to ignore instructions embedded in these data sources. The skill has broad capabilities including file system write access and engine command execution. - [DYNAMIC_EXECUTION]: The skill uses dynamic execution to interact with the Unreal Engine environment. It utilizes
ue_remote.PythonRemote().exec()to run dynamically generated Python code within the editor and constructs HLSL shader code strings that are injected into custom material nodes. - [COMMAND_EXECUTION]: The skill executes internal Unreal Engine console commands for system configuration (e.g.,
r.Substrate) and performance profiling (e.g.,stat streaming) usingunreal.SystemLibrary.execute_console_command. - [EXTERNAL_DOWNLOADS]: The skill includes instructions for the agent to download and install additional components from the author's repository using the
npx skills add scenario-labs/skillscommand.
Audit Metadata