scenario-unreal-pipeline-automation

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill uses dynamic module loading through the __import__ function in scripts/ue_pipeline.py to load logic from related skills (such as 'scenario-unreal-expert') located in sibling directories. This is a mechanism for code reuse across the author's local skill ecosystem.
  • [COMMAND_EXECUTION]: The scripts execute shell commands using subprocess.run to interact with system utilities such as Perforce (p4) for source control and pgrep for process monitoring, which are necessary functions for professional pipeline management.
  • [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it ingests and processes external data from DCC exports (FBX, OBJ, USD) and associated JSON manifests to automate import settings and asset class assignments.
  • Ingestion points: File scanning and manifest reading functions in scripts/ue_pipeline.py (scan_sources, read_dcc_manifest).
  • Boundary markers: The skill enforces strict naming conventions and utilizes explicit import policy versioning to validate incoming data.
  • Capability inventory: The skill possesses the ability to write to the local filesystem, create or delete engine assets, and execute shell commands via subprocess.
  • Sanitization: The skill employs standard sanitization practices including the use of shlex for command line assembly and regex-based filtering for asset naming.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 08:49 AM