sgdk-combat

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The build script (assets/combat-lab/tools/build.py) executes docker to compile the C source into a ROM. The command is safely constructed as a list, which prevents command injection vulnerabilities by avoiding shell-based argument parsing.
  • [EXTERNAL_DOWNLOADS]: The build process fetches a specialized SDK environment from the author's Docker Hub repository (ewrogers/sgdk). This is a legitimate vendor resource used for the project toolchain.
  • [DYNAMIC_EXECUTION]: Python scripts in the tools directory procedurally generate art and audio assets at build time. This includes generating C header files containing font and UI data, which are then compiled into the final binary.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to integrate combat logic into user-provided project codebases.
  • Ingestion points: User-provided game logic and geometric collision queries in the SGDK project (SKILL.md).
  • Boundary markers: None present; the skill operates under the assumption of a trusted developer environment.
  • Capability inventory: The skill includes file system write operations (prepare.py) and Docker-based command execution (build.py).
  • Sanitization: The build scripts utilize path resolution and strict argument validation through argparse to mitigate risks of path traversal or command manipulation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 02:32 AM