se2-dev-game-code

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: During the preparation phase, the skill downloads several utility tools from well-known services:
  • Fetches the uv package manager installer from its official domain (https://astral.sh).
  • Downloads the busybox executable for Windows from https://frippery.org, a recognized source for the Windows port.
  • Installs the ilspycmd decompiler using the official .NET SDK tool registry (dotnet tool install).
  • [COMMAND_EXECUTION]: The skill uses shell commands and Python's subprocess module for legitimate operational tasks:
  • The Prepare.bat and prepare.sh scripts manage the local environment using git, powershell, and file system utilities.
  • check_version.py executes the ilspycmd tool to extract version information from game binaries.
  • Test scripts (test_search_code.py and test_graphify_queries.py) execute local search and graph queries to verify skill functionality.
  • The implementation correctly passes arguments as lists to subprocess.run(), which prevents shell injection vulnerabilities.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses local game installation directories and the Windows Registry to locate Space Engineers 2 files for decompilation. It maintains all processed data (indexes and source code) in a local directory (~/.se2-dev/game-code). There is no evidence of sensitive data access or unauthorized exfiltration to external servers.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 02:22 PM