megadev-debug
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/lookup_address.pyand its duplicate inassets/debug-lab/tools/execute toolchain binaries (m68k-elf-nm,m68k-elf-addr2line) viasubprocess.runto resolve CPU addresses to source lines. - [COMMAND_EXECUTION]: The script
assets/debug-lab/tools/check_symbols.pyexecutesm68k-elf-nmto qualify build symbols against expected ELF hashes. - [EXTERNAL_DOWNLOADS]: Project documentation in
assets/debug-lab/README.mdandreferences/symbols-and-exceptions.mddirects users to pull theewrogers/megadev:latestDocker image from Docker Hub for the build environment. This is a vendor-owned resource consistent with the skill's authorship. - [INDIRECT_PROMPT_INJECTION]: The skill processes external ELF files which could potentially contain malicious metadata designed to influence the output of diagnostic tools.
- Ingestion points:
scripts/lookup_address.pyreads binary ELF files provided as command-line arguments. - Boundary markers: The script performs SHA-256 hash verification against a user-supplied hash to ensure the file matches a known build identity.
- Capability inventory:
subprocess.runcalls to binutils are present inscripts/lookup_address.pyandassets/debug-lab/tools/check_symbols.py. - Sanitization: PC alignment checks and address range validation are performed on inputs before they are passed to toolchain binaries.
Audit Metadata