megadev-performance
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
assets/performance-lab/tools/check_work.pyusessubprocess.runto invoke the host system's C compiler (gcc,clang, orcc). This is used to verify the mathematical correctness of the performance kernels before they are deployed to the Sega CD environment. - [DYNAMIC_EXECUTION]: The
check_work.pyscript performs a runtime build-and-run cycle. It compilesperf.candwork_checks.cinto a temporary executable and runs it to ensure the logic matches the project's performance requirements. - [INDIRECT_PROMPT_INJECTION]: The skill implements a workflow for processing performance results in JSON format via
scripts/compare_runs.py. - Ingestion points: The tool reads performance counter data from local JSON files provided by the user.
- Boundary markers: The
validate()function in the script enforces a strict schema, ensuring only expected keys are present. - Capability inventory: The script's operations are limited to mathematical calculations (rate computation) and printing results to standard output; it does not perform network operations or file modifications.
- Sanitization: All ingested values are strictly validated to be either booleans or integers within the unsigned 16-bit range (0-65535).
- [EXTERNAL_DOWNLOADS]: The
README.mdfile recommends that users pull theewrogers/megadev:latestDocker image. As this resource is provided by the skill author, it represents standard vendor-provided tooling for the build environment.
Audit Metadata