Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Unreal Skill
v1.0.0Control and automate Unreal Editor tasks via OpenClaw AI using HTTP endpoints for level, actor, transform, component, editor, debug, input, asset, console, a...
⭐ 0· 1k·2 current·2 all-time
byTom Jaejoon Lee@tomleelive
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill name/description (Unreal Editor control) matches the included code (an HTTP handler that exposes /unreal/* endpoints and a registered 'unreal_execute' tool). There are no unrelated environment variables, binaries, or surprising external services requested.
Instruction Scope
SKILL.md and SKILL_KO.md limit actions to connecting via the OpenClaw Gateway or running an MCP server, registering/polling sessions, queuing commands, reading project logs, and controlling editor state. The docs do include troubleshooting steps like removing /Plugins/OpenClaw/Binaries and /Intermediate (which can be destructive to build artefacts) and recommend running a node MCP bridge from the project tree — both are expected for a plugin but worth caution.
Install Mechanism
This is effectively an instruction-only skill with source code included in the package (extension/index.ts). There is no remote download or extract step in the manifest; nothing in the package attempts to fetch arbitrary code at install time.
Credentials
No environment variables, credentials, or config paths are requested. The code does enable CORS (Access-Control-Allow-Origin: *) and listens on known ports (gateway default 18789 and MCP default 27184), which is functionally necessary but increases network exposure surface if those ports are reachable externally.
Persistence & Privilege
always:false and the skill is user-invocable; disable-model-invocation remains false (agent may call the skill autonomously), which is platform default. Because the skill can perform destructive editor actions (actor.delete, asset.import, editor.play/stop, console.execute), you should consider disabling autonomous invocation or restricting usage if you don't want the model to perform changes without explicit approval.
Assessment
Before installing: 1) Verify provenance — the package has no homepage and the registry owner is an opaque ID; inspect extension/index.ts yourself to confirm behavior. 2) Backup your Unreal project and test in a disposable project first — the docs include rm -rf cleanup commands and the skill can delete or modify actors/assets. 3) Limit network exposure — ensure OpenClaw Gateway (18789) and MCP (27184) are bound to localhost or firewalled so they are not reachable from the public internet; the code sets Access-Control-Allow-Origin: * which can increase risk if ports are exposed. 4) Consider setting disableModelInvocation=true (or otherwise requiring explicit user confirmation) if you want to prevent the agent from autonomously issuing destructive commands. 5) If you decide to proceed, review the full index.ts (already included) for any additional behavior, and run the plugin only in projects where accidental changes are tolerable.Like a lobster shell, security has layers — review code before you run it.
latestvk971c9zapzhga1frbqg6km7671815887
License
MIT-0
Free to use, modify, and redistribute. No attribution required.