Unreal Skill

Control and automate Unreal Editor tasks via OpenClaw AI using HTTP endpoints for level, actor, transform, component, editor, debug, input, asset, console, a...

Before installing: 1) Verify provenance — the package has no homepage and the registry owner is an opaque ID; inspect extension/index.ts yourself to confirm behavior. 2) Backup your Unreal project and test in a disposable project first — the docs include rm -rf cleanup commands and the skill can delete or modify actors/assets. 3) Limit network exposure — ensure OpenClaw Gateway (18789) and MCP (27184) are bound to localhost or firewalled so they are not reachable from the public internet; the code sets Access-Control-Allow-Origin: * which can increase risk if ports are exposed. 4) Consider setting disableModelInvocation=true (or otherwise requiring explicit user confirmation) if you want to prevent the agent from autonomously issuing destructive commands. 5) If you decide to proceed, review the full index.ts (already included) for any additional behavior, and run the plugin only in projects where accidental changes are tolerable.

Type: OpenClaw Skill Name: openclaw-unreal-skill Version: 1.0.0 The skill provides extensive control over Unreal Engine Editor, including the `console.execute` tool (via `unreal_execute` in `extension/index.ts`). This allows the AI agent to run arbitrary console commands within the Unreal Editor, which could lead to Remote Code Execution (RCE) if the Unreal Editor plugin does not properly sanitize or restrict inputs. While this is a significant vulnerability risk, the skill's code itself does not exhibit malicious intent such as data exfiltration, backdoor installation, or direct system command execution. The `SKILL.md` and `SKILL_KO.md` documentation accurately describe these powerful capabilities, and `SKILL_KO.md` even includes a section on `disableModelInvocation` for sensitive tools, indicating an awareness of security implications. The broad `Access-Control-Allow-Origin: *` in `extension/index.ts` is also noted but common for local integration.