scenario-unreal-performance

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The toolkit in scripts/ue_perf.py utilizes importlib.import_module to dynamically load sibling utility modules from the scenario-unreal-expert skill directory. Additionally, references/procedures.md demonstrates the use of exec_module to load and run the job_probe_perf.py script at runtime.\n- [COMMAND_EXECUTION]: The skill performs extensive interaction with the local system and the Unreal Engine toolchain via subprocess.run, including running the TraceQuery JSONL parser, system thermal monitoring utilities like pmset, and launching the project's game binaries for profiling.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection. Ingestion points: Processes external data from Unreal Engine trace files (JSONL) and engine logs (stat unit, ProfileGPU) within scripts/ue_perf.py. Boundary markers: Lacks explicit delimiters or warnings to ignore embedded instructions in the ingested data. Capability inventory: Includes shell command execution via subprocess.run, remote execution in Unreal Editor via ue_remote.exec, and project configuration modification. Sanitization: Employs regex-based parsing to extract numeric values from logs, providing implicit filtering, but provides diagnostic 'advice' based on processed data.\n- [COMMAND_EXECUTION]: The skill provides the ability to programmatically modify project-level Unreal configuration files (DefaultDeviceProfiles.ini, DefaultEngine.ini) to apply optimization settings, which is a high-capability operation performed via file I/O operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 05:52 AM