Skills unreal-engine-developer
📦

unreal-engine-developer

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Build Unreal Engine Projects With AI

Unreal Engine automation often requires switching between editor tools, Python scripts, and Blueprint tasks. This skill guides Claude, Codex, and Claude Code through editor control, asset work, level design, and verification.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "unreal-engine-developer" from https://skillstore.io/skills/dammianmiller-unreal-engine-developer.md and its manifest at https://skillstore.io/api/skills/dammianmiller-unreal-engine-developer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dammianmiller-unreal-engine-developer.md Signed manifest GET /api/skills/dammianmiller-unreal-engine-developer/manifest Signed lockfile GET /api/skills/dammianmiller-unreal-engine-developer/lockfile

Test it

Using "unreal-engine-developer". Create a small Unreal test scene with a grid of props and simple lighting.

Expected outcome:

The skill would provide an editor automation plan, actor placement details, material choices, save steps, and a short verification checklist.

Using "unreal-engine-developer". Prepare selected assets for a technical art review.

Expected outcome:

The skill would inspect selected assets, propose naming and material changes, request approval, and describe the final asset updates.

Using "unreal-engine-developer". Create a Blueprint actor for an interactive prototype.

Expected outcome:

The skill would outline the Blueprint class, components, variables, event flow, compile checks, and level placement steps.

Security Audit

High Risk
v8 • 7/5/2026 Open versioned report

Most Markdown backtick findings are false positives, but the skill includes real high-risk editor automation. Confirmed risks include screenshot capture, arbitrary Unreal Python and console command execution, all-interface binding guidance, and unpinned third-party MCP server execution. No prompt injection text was found in SKILL.md or references.md.

2
Files scanned
546
Lines analyzed
10
Review items
0
False positives ignored

Confirmed security concerns (4)

High
references.md:53
Screen capture upload
editor_take_screenshot - Viewport capture
references.md lists editor_take_screenshot as a viewport capture tool. Capturing editor visuals can expose unreleased project content to the agent or downstream services.
High
SKILL.md:59
Screen capture upload
| `editor_take_screenshot` | Capture viewport screenshot |
SKILL.md lists editor_take_screenshot as a supported tool. Capturing viewport screenshots can disclose proprietary game visuals or editor state.
High
SKILL.md:358
Screen capture upload
- [ ] Screenshots captured for visual verification when relevant
The checklist instructs agents to capture screenshots for visual verification when relevant. This normalizes screenshot capture and needs explicit user consent controls.
High
SKILL.md:35-40SKILL.md:77-86
Unpinned External MCP Server Execution
The setup guidance runs third-party Unreal MCP servers through npx and uv without pinned versions or integrity checks. A compromised package or script could gain editor automation access.
The file explicitly configures npx -y @runreal/unreal-mcp and uv run unreal_mcp_server.py. The risk depends on installation context, but the unpinned execution path is clear.
Capability review items (10)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
SKILL.md:49-50
Ruby/shell backtick execution
| `editor_run_python` | Execute any Python within Unreal Editor |
The line explicitly exposes editor_run_python, described as executing any Python within Unreal Editor. That capability can modify project assets or run unsafe editor automation if used without confirmation.
High
SKILL.md:59-60
Ruby/shell backtick execution
| `editor_take_screenshot` | Capture viewport screenshot |
The line documents editor_take_screenshot for viewport capture. Screenshot capture can expose project visuals and should require explicit user approval.
High
SKILL.md:368
Ruby/shell backtick execution
3. Try bind address `0.0.0.0` instead of `127.0.0.1`
The line recommends binding to 0.0.0.0 instead of 127.0.0.1 during MCP troubleshooting. That can expose remote execution services beyond the local host.
High
SKILL.md:368
Hardcoded IP address
3. Try bind address `0.0.0.0` instead of `127.0.0.1`
The troubleshooting guidance recommends 0.0.0.0 instead of 127.0.0.1. Binding an editor automation service to all interfaces can expose the project to network access.
Medium
SKILL.md:35-44
Ruby/shell backtick execution
```json
The JSON block includes command npx with -y for @runreal/unreal-mcp, which executes a third-party MCP server during startup. This is legitimate setup guidance but still a real external execution and supply-chain risk.
Medium
SKILL.md:51-52
Ruby/shell backtick execution
| `editor_export_asset` | Export asset to text |
editor_export_asset exports asset content to text, which can disclose proprietary project data if returned outside the editor context. The risk is contextual, but the data extraction capability is real.
Medium
SKILL.md:57-58
Ruby/shell backtick execution
| `editor_delete_object` | Delete actor from world |
The line documents deleting actors from the world. This is not Ruby backtick execution, but it is a real destructive editor capability that needs user confirmation.
Medium
SKILL.md:58-59
Ruby/shell backtick execution
| `editor_console_command` | Run console command |
editor_console_command is explicitly described as running Unreal console commands. Console execution can alter editor state or diagnostics and should be treated as a real command capability.
Medium
SKILL.md:77-91
Ruby/shell backtick execution
```json
The JSON block starts an MCP server with uv run unreal_mcp_server.py. Running a local MCP server script is a real external execution risk if the source is not pinned and reviewed.
Medium
SKILL.md:343
Python file write/append
with open(output_path, 'w') as f:
The example writes JSON to a caller-provided output_path without constraining the destination. It is a legitimate export example, but arbitrary paths can overwrite local files if misused.

Risk Factors

⚙️ External commands (36)
SKILL.md:35-44 SKILL.md:44-49 SKILL.md:49-50 SKILL.md:50-51 SKILL.md:51-52 SKILL.md:52-53 SKILL.md:53-54 SKILL.md:54-55 SKILL.md:55-56 SKILL.md:56-57 SKILL.md:57-58 SKILL.md:58-59 SKILL.md:59-60 SKILL.md:60-72 SKILL.md:72-77 SKILL.md:77-91 SKILL.md:91-115 SKILL.md:115-151 SKILL.md:151-155 SKILL.md:155-180 SKILL.md:180-184 SKILL.md:184-205 SKILL.md:205-209 SKILL.md:209-236 SKILL.md:236-244 SKILL.md:244-259 SKILL.md:259-281 SKILL.md:281-298 SKILL.md:298-302 SKILL.md:302-314 SKILL.md:314-318 SKILL.md:318-345 SKILL.md:345-368 SKILL.md:368 SKILL.md:375-377 SKILL.md:377
🌐 Network access (6)
SKILL.md:390 SKILL.md:391 SKILL.md:392 SKILL.md:393 SKILL.md:394 SKILL.md:368
📁 Filesystem access (1)
SKILL.md:343

Detected Patterns

Screen capture upload×3
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/dammianmiller-unreal-engine-developer/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dammianmiller-unreal-engine-developer/security.svg)](https://skillstore.io/skills/dammianmiller-unreal-engine-developer?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dammianmiller-unreal-engine-developer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dammianmiller-unreal-engine-developer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dammianmiller-unreal-engine-developer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

DammianMiller. (2026). unreal-engine-developer security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dammianmiller-unreal-engine-developer/audits/8

BibTeX citation

@techreport{dammianmiller-dammianmiller-unreal-engine-developer-2026, author = {DammianMiller}, title = {unreal-engine-developer security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/dammianmiller-unreal-engine-developer/audits/8}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "unreal-engine-developer security audit report (audit version 8)" version: "unspecified" type: report authors: - name: "DammianMiller" date-released: "2026-07-05" url: "https://skillstore.io/skills/dammianmiller-unreal-engine-developer/audits/8" identifiers: - type: other value: "skillstore:dammianmiller-unreal-engine-developer:audit:8" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
72
Community
83
Spec Compliance

What You Can Build

Prototype Playable Levels

Create blockouts, place actors, adjust transforms, and verify level changes through Unreal editor automation.

Automate Asset Pipelines

Batch import assets, create materials, assign meshes, rename selections, and save updated content packages.

Build Blueprint Workflows

Create Blueprint classes, add components, compile assets, and spawn Blueprint actors for gameplay prototypes.

Try These Prompts

Set Up Unreal MCP 
Help me configure Unreal Engine for MCP control. Check the required plugins, project settings, and client configuration before running anything.
Create a Simple Level 
Plan a small Unreal Engine test level, then create actors, assign meshes, position lights, save the level, and summarize every change.
Clean Up Selected Assets 
Review my selected Unreal assets, propose a safe batch rename and material assignment plan, then wait for approval before making changes.
Design a Blueprint System 
Design a Blueprint actor workflow for a reusable gameplay object. Include components, variables, events, validation steps, and rollback guidance.

Best Practices

  • Review every planned editor operation before allowing asset writes, deletes, imports, or console commands.
  • Keep MCP servers bound to localhost unless a trusted network setup is explicitly required.
  • Save backups or use source control before running batch Unreal Python or Blueprint automation.

Avoid

  • Running unpinned MCP servers or plugins without reviewing their source and version.
  • Capturing or sharing viewport screenshots without confirming that project visuals may be exposed.
  • Using broad Python scripts on production projects before testing them in a disposable level.

Frequently Asked Questions

What does this skill help automate?
It helps AI agents work with Unreal Engine editor setup, Python scripting, asset management, levels, Blueprints, and verification tasks.
Does it require an MCP server?
Yes, editor control requires an Unreal MCP setup or another approved path for running Unreal Python commands.
Can it modify my project files?
Yes. The workflows include asset writes, level saves, actor changes, imports, and deletes when the connected tools allow them.
Can it create Blueprints?
Yes. It includes guidance for creating Blueprint classes, adding components, compiling Blueprints, and spawning Blueprint actors.
Is screenshot capture required?
No. Screenshots are only useful for visual verification and should require explicit user approval before capture or sharing.
Which AI tools are supported?
The report lists support for Claude, Codex, and Claude Code, assuming the user configures compatible MCP access.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/DammianMiller/universal-agent-memory/tree/main/.factory/skills/unreal-engine-developer

Ref

7e9e368dc1a370f2040369ebcd0db06d90cb48e5

Maintenance freshness

7/18/2026

Usage

12 downloads · 304 views

File structure

📄 references.md

📄 SKILL.md