sgdk-effects

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The assets/effects-lab/tools/build.py script uses subprocess.run to invoke the Docker CLI. The command is constructed as a list of arguments rather than a shell string, and variables like --platform and --mode are strictly validated through argparse choices, preventing command injection.
  • [EXTERNAL_DOWNLOADS]: The skill requires a Docker image (ewrogers/sgdk:latest) which is pullable from Docker Hub. This image is a resource provided by the author (ewrogers) to facilitate the build environment and is used as intended for compilation.
  • [DYNAMIC_EXECUTION]: The build process involves cross-compiling C code into a Mega Drive ROM. While this involves executing code within a container, it is the primary purpose of the skill and is performed using static source files provided within the skill package.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 02:47 AM