If the Python Script Plugin is enabled, Unreal Editor runs any file named init_unreal.py found in its configured Python paths automatically, and runs the startup scripts listed in Project Settings after the default level loads. So a project or plugin you downloaded can include Python that runs on open. Check before you enable the plugin.
What Epic's documentation says
Epic's page on scripting the Unreal Editor with Python describes several ways to run a script. Three matter for intake:
- init_unreal.py. If the Editor detects a script file called
init_unreal.pyin any of the paths it is configured to use, it automatically runs that script immediately. Epic suggests placing it in theContent/Pythonfolder of a project or plugin when everyone needs the same initialization. - Startup scripts. In Project Settings you can list any number of Python scripts to run every time that project opens. The Editor runs them after the default startup level is fully loaded.
- Command line. Launching with
ExecutePythonScriptruns a named script, which requires the Python plugin to be enabled in the project.
The page also says you must have already enabled the Python Scripting Plugin in the project for the command line route.
Why it is relevant to supply chain review
These are legitimate, helpful features for pipelines. The same behavior means a plugin's Content/Python folder is a place code can live that runs without anyone clicking anything. Plugin descriptors are likewise discovered and loaded automatically by the Engine, Editor and UnrealBuildTool whenever they run, and projects detect plugins in the Plugins folder at startup.
None of this says plugins are unsafe. It says that "open the project" is an execution event, and your intake process should treat it as one. The post on whether an Unreal plugin runs code at build time covers the C# build side. This post covers the Python side.
A pre-open checklist
| Step | What to do |
|---|---|
| 1 | Copy the project or plugin to a scratch folder without opening it in the editor |
| 2 | Search for init_unreal.py anywhere in the tree |
| 3 | Open the project's config files and look for the Python startup scripts setting |
| 4 | Read each script found. Look for network calls, file deletion, process launching and encoded blobs |
| 5 | Check which plugins the project enables, including the Python Script Plugin |
| 6 | Open on a machine with no signed-in credentials if you cannot read everything |
A simple search, using any text search tool, is enough for step 2. If you find nothing, you have still learned something useful.
For your own projects
If your team uses startup scripts, treat them like any other code in review: pull requests, an owner, and no secrets in the script. Keep them small. If a script needs credentials, take them from the environment at run time, not from the file.
Also record that the Python plugin is enabled and why. A project that does not need Python automation can leave it off, which removes this execution route.
Where scanning fits
Safeguard's SBOM and dependency scanning covers the packages and libraries your repositories declare, and you can try a free scan at gold.safeguard.sh/scan. A pre-open search for startup scripts is a separate manual step, but cheap enough to add to your intake checklist.
Quick check
Does init_unreal.py need me to click anything?
Per Epic's documentation, if the Editor finds it in a configured path it runs it automatically, with the Python plugin enabled in the project.
Can I run a Python script without opening the full editor?
Epic's page describes command line options for running scripts, and lists a full Editor approach as one option. Check the page for the exact flags for your engine version.
Should I turn the Python plugin off?
If your project does not use Python automation, leaving it disabled removes this route. If you use it, review the scripts like code.
Sources
Last reviewed: 19 October 2026.
