megadev-compression
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external asset data but implements a robust validation layer. The function
cp_kos_validincompress.cwalks compressed source streams to verify descriptor boundaries, history references, and output capacity before execution, establishing a memory safety boundary for untrusted disc data. - [EXTERNAL_DOWNLOADS]: The build documentation instructs the user to pull the
ewrogers/megadev:latestDocker image. This is a vendor-owned resource directly associated with the skill's author and serves as the primary development toolkit for the Sega CD target. - [COMMAND_EXECUTION]: The repository includes scripts like
create_project.pythat perform file system operations to generate standalone project folders. These operations are limited to the user-specified destination and do not involve unauthorized system modifications. - [DYNAMIC_EXECUTION]: While the skill involves building and executing code for the Sega CD platform, this occurs within a controlled development workflow using an emulator ('ares') or target hardware, with no evidence of dynamic code generation or execution on the host machine beyond the provided build tools.
Audit Metadata