sgdk-effects
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
assets/effects-lab/tools/build.pyscript usessubprocess.runto invoke the Docker CLI. The command is constructed as a list of arguments rather than a shell string, and variables like--platformand--modeare strictly validated throughargparsechoices, preventing command injection. - [EXTERNAL_DOWNLOADS]: The skill requires a Docker image (
ewrogers/sgdk:latest) which is pullable from Docker Hub. This image is a resource provided by the author (ewrogers) to facilitate the build environment and is used as intended for compilation. - [DYNAMIC_EXECUTION]: The build process involves cross-compiling C code into a Mega Drive ROM. While this involves executing code within a container, it is the primary purpose of the skill and is performed using static source files provided within the skill package.
Audit Metadata