megadev-project
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/everdrive.pyfacilitates project builds by invoking Docker viasubprocess.run. This is a standard functional requirement for the toolchain, and the implementation uses structured argument lists to prevent shell injection. - [EXTERNAL_DOWNLOADS]: The skill utilizes the
ewrogers/megadevDocker image hosted on Docker Hub. This is a vendor-owned resource necessary for the project's development environment and is used as intended for building the Sega CD software. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided source code and Makefiles during the disc creation process. The security risk is mitigated by the use of an isolated Docker container for the build environment, which limits the potential impact of malicious project files.
- [DATA_EXPOSURE]: The deployment utility
scripts/disc_bundle.pyincludes logic to explicitly excludebios.binfiles from being packaged onto the disc. This is a security-conscious design choice that prevents the accidental distribution of protected system firmware.
Audit Metadata