unreal-actor-operations
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill operates within the expected scope of Unreal Engine automation. It utilizes specific MCP tools for Python execution that are standard for this development environment. No unauthorized network activity, credential harvesting, or obfuscation patterns were detected. All code examples and scripts align with official Unreal Engine Python API documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data through CSV imports and asset path resolution. While these features are necessary for the skill's primary purpose of actor management, they represent a surface for indirect prompt injection if the processed data originates from untrusted sources.
- Ingestion points: CSV file data (referenced in SKILL.md workflows) and asset paths passed to
unreal.load_asset. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are included in the documentation for handling external data.
- Capability inventory: The skill utilizes the
mcp__ue58-mcp__execute_python_codetool, which provides full Python API access to the Unreal Engine editor environment. - Sanitization: No sanitization or validation logic for external inputs is described in the provided examples or troubleshooting guides.
Audit Metadata