Some assets are just data and some are code in disguise, and the engine documentation tells you which is which. Godot packs can hold scripts, Unity AssetBundles hold non-code assets, and Unreal plugins can carry code and content. Treat each by its documented contents, not by the word "asset".
Myth 1: "A mod pack is just art"
Fact. Godot's documentation says PCK and ZIP packs usually contain scripts, scenes, shaders, models, textures and sound, and can even be an entire Godot project. It lists loading a malicious mod as a security scenario. See the PCK security guide.
Myth 2: "A Unity AssetBundle can install new code"
Fact. Unity describes bundles as holding non-code assets such as models, textures, prefabs, audio clips and scenes. The documentation does not describe bundles as carrying compiled scripts. The risk is elsewhere: who hosts them, whether you verify them, and what existing scripts do with the content. See the AssetBundle guide.
Myth 3: "If it is in the Editor folder, it cannot hurt me"
Fact. Unity says Editor scripts are not available in Player builds at runtime, so they do not reach players. But they run on developer machines during authoring, where source code and credentials live. Different exposure, not no exposure.
Myth 4: "An Unreal plugin only matters when I package the game"
Fact. Epic says plugin descriptors are discovered and loaded automatically by the Engine, Editor and UnrealBuildTool whenever those run, and project plugins load at editor startup. Epic also documents that an init_unreal.py file is run automatically when found in a configured Python path. So a plugin can matter the moment you open the project. See what runs when you open an Unreal project.
Myth 5: "A signed package is a safe package"
Fact. Unity's package signature helps verify where a package came from and that it was not changed after the developer created it. It says nothing about whether the code is free of flaws. Unity's own table also lists a signed state from an organization you do not belong to, with advice to be certain of the source. See what each signature status means.
Summary table
| Item | Can it carry code | Documented source |
|---|---|---|
| Godot PCK or ZIP pack | Yes, scripts | Godot export docs |
| Unity AssetBundle | Documented as non-code assets | Unity AssetBundle manual |
| Unity Editor folder scripts | Yes, editor only | Unity reserved folders |
| Unity native plug-in | Yes, native libraries | Unity native plug-ins page |
| Unreal plugin | Yes, modules and content | Epic plugin docs |
A habit that replaces the myths
For every outside item, ask three questions: Can it run code? When does it run, at authoring time or in the game? Who can change it after I accepted it? Write the answers in your plugin register. The answers decide how much review you spend.
Safeguard's SBOM and dependency scanning can inventory what your repositories declare, and you can try a free scan at gold.safeguard.sh/scan. The three questions above come before any tool.
Quick check
Which asset type should I review first?
Start with anything that can carry scripts or native code: packs, plugins and editor tools. Data only content is a smaller concern.
Do these docs apply to every engine version?
Not necessarily. They describe current documentation as fetched in October 2026, so check the page for your version.
Sources
- Godot documentation: Exporting packs, patches, and mods
- Unity Manual: Introduction to AssetBundles
- Unity Manual: Reserved folder names
- Unity Manual: Introduction to package signatures
- Epic Games: Plugins in Unreal Engine
- Epic Games: Scripting the Unreal Editor using Python
Last reviewed: 19 October 2026.
