megadev-debug

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/lookup_address.py and its duplicate in assets/debug-lab/tools/ execute toolchain binaries (m68k-elf-nm, m68k-elf-addr2line) via subprocess.run to resolve CPU addresses to source lines.
  • [COMMAND_EXECUTION]: The script assets/debug-lab/tools/check_symbols.py executes m68k-elf-nm to qualify build symbols against expected ELF hashes.
  • [EXTERNAL_DOWNLOADS]: Project documentation in assets/debug-lab/README.md and references/symbols-and-exceptions.md directs users to pull the ewrogers/megadev:latest Docker image from Docker Hub for the build environment. This is a vendor-owned resource consistent with the skill's authorship.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external ELF files which could potentially contain malicious metadata designed to influence the output of diagnostic tools.
  • Ingestion points: scripts/lookup_address.py reads binary ELF files provided as command-line arguments.
  • Boundary markers: The script performs SHA-256 hash verification against a user-supplied hash to ensure the file matches a known build identity.
  • Capability inventory: subprocess.run calls to binutils are present in scripts/lookup_address.py and assets/debug-lab/tools/check_symbols.py.
  • Sanitization: PC alignment checks and address range validation are performed on inputs before they are passed to toolchain binaries.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:47 PM