megadev-compression

Pass

Audited by Gen Agent Trust Hub on Oct 20, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external asset data but implements a robust validation layer. The function cp_kos_valid in compress.c walks compressed source streams to verify descriptor boundaries, history references, and output capacity before execution, establishing a memory safety boundary for untrusted disc data.
  • [EXTERNAL_DOWNLOADS]: The build documentation instructs the user to pull the ewrogers/megadev:latest Docker image. This is a vendor-owned resource directly associated with the skill's author and serves as the primary development toolkit for the Sega CD target.
  • [COMMAND_EXECUTION]: The repository includes scripts like create_project.py that perform file system operations to generate standalone project folders. These operations are limited to the user-specified destination and do not involve unauthorized system modifications.
  • [DYNAMIC_EXECUTION]: While the skill involves building and executing code for the Sega CD platform, this occurs within a controlled development workflow using an emulator ('ares') or target hardware, with no evidence of dynamic code generation or execution on the host machine beyond the provided build tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 20, 2026, 06:45 AM