megadev-input

SUSPICIOUS. The skill’s purpose and capabilities are largely coherent for game-input integration, and the scanner’s command-substitution hits are documentation artifacts. The main risk is supply-chain trust: it instructs running an unpinned third-party Docker image (`ewrogers/megadev:latest`) that is not clearly the same publisher as the upstream Megadev source it cites, so the execution footprint exceeds what can be fully verified from the skill alone.