megadev-ai

Pass

Audited by Gen Agent Trust Hub on Oct 20, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script assets/enemy-lab/tools/check_enemy.py performs runtime compilation and execution of C code on the host system.
  • It uses the subprocess module to invoke a C compiler (e.g., clang, cc, or gcc) on the source files enemy.c and test_enemy.c.
  • The resulting binary is then executed to perform work-bound and behavior checks for the AI engine.
  • [EXTERNAL_DOWNLOADS]: Build instructions in assets/enemy-lab/README.md require pulling the Docker image ewrogers/megadev:latest from a public registry.
  • This image is provided by the author of the skill and is used for building and mastering the game discs.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates an environment where the agent generates C code that is subsequently executed locally, creating a vulnerability surface.
  • Ingestion points: The agent ingests game logic, enemy rules, and navigation requirements to implement AI states in C code, as described in SKILL.md.
  • Boundary markers: No explicit markers or warnings are used to instruct the agent to disregard instructions potentially embedded in the game data or rule definitions it processes.
  • Capability inventory: The skill provides a script (check_enemy.py) with the capability to compile and run the generated C code via subprocess calls.
  • Sanitization: There are no sanitization or validation steps to ensure that the generated C code is safe before it is compiled and executed on the host.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 20, 2026, 06:43 AM