megadev-scaling

SUSPICIOUS: The skill’s capabilities fit its Sega CD graphics purpose and it does not request credentials or exfiltrate data, but its build path depends on an unpinned Docker image from a publisher not clearly verified as the official Megadev source. The scanner findings themselves are benign documentation examples; the main risk is supply-chain trust, not malicious behavior.