megadev-ai
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
assets/enemy-lab/tools/check_enemy.pyperforms runtime compilation and execution of C code on the host system. - It uses the
subprocessmodule to invoke a C compiler (e.g., clang, cc, or gcc) on the source filesenemy.candtest_enemy.c. - The resulting binary is then executed to perform work-bound and behavior checks for the AI engine.
- [EXTERNAL_DOWNLOADS]: Build instructions in
assets/enemy-lab/README.mdrequire pulling the Docker imageewrogers/megadev:latestfrom a public registry. - This image is provided by the author of the skill and is used for building and mastering the game discs.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates an environment where the agent generates C code that is subsequently executed locally, creating a vulnerability surface.
- Ingestion points: The agent ingests game logic, enemy rules, and navigation requirements to implement AI states in C code, as described in
SKILL.md. - Boundary markers: No explicit markers or warnings are used to instruct the agent to disregard instructions potentially embedded in the game data or rule definitions it processes.
- Capability inventory: The skill provides a script (
check_enemy.py) with the capability to compile and run the generated C code via subprocess calls. - Sanitization: There are no sanitization or validation steps to ensure that the generated C code is safe before it is compiled and executed on the host.
Audit Metadata