megadev-performance

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script assets/performance-lab/tools/check_work.py uses subprocess.run to invoke the host system's C compiler (gcc, clang, or cc). This is used to verify the mathematical correctness of the performance kernels before they are deployed to the Sega CD environment.
  • [DYNAMIC_EXECUTION]: The check_work.py script performs a runtime build-and-run cycle. It compiles perf.c and work_checks.c into a temporary executable and runs it to ensure the logic matches the project's performance requirements.
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow for processing performance results in JSON format via scripts/compare_runs.py.
  • Ingestion points: The tool reads performance counter data from local JSON files provided by the user.
  • Boundary markers: The validate() function in the script enforces a strict schema, ensuring only expected keys are present.
  • Capability inventory: The script's operations are limited to mathematical calculations (rate computation) and printing results to standard output; it does not perform network operations or file modifications.
  • Sanitization: All ingested values are strictly validated to be either booleans or integers within the unsigned 16-bit range (0-65535).
  • [EXTERNAL_DOWNLOADS]: The README.md file recommends that users pull the ewrogers/megadev:latest Docker image. As this resource is provided by the skill author, it represents standard vendor-provided tooling for the build environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:46 PM