megadev-project

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/everdrive.py facilitates project builds by invoking Docker via subprocess.run. This is a standard functional requirement for the toolchain, and the implementation uses structured argument lists to prevent shell injection.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the ewrogers/megadev Docker image hosted on Docker Hub. This is a vendor-owned resource necessary for the project's development environment and is used as intended for building the Sega CD software.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided source code and Makefiles during the disc creation process. The security risk is mitigated by the use of an isolated Docker container for the build environment, which limits the potential impact of malicious project files.
  • [DATA_EXPOSURE]: The deployment utility scripts/disc_bundle.py includes logic to explicitly exclude bios.bin files from being packaged onto the disc. This is a security-conscious design choice that prevents the accidental distribution of protected system firmware.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:46 PM