sgdk-gameplay

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The project build instructions reference a Docker image ewrogers/sgdk:2.11-gcc16.2.0-binutils2.47 from the author's repository. This image serves as the compilation environment for the Mega Drive ROM and is pinned with a SHA256 hash for integrity.
  • [COMMAND_EXECUTION]: The skill includes a Python script scripts/make_lab_art.py which is intended to generate PNG assets for the gameplay lab. It also provides a shell command for running the Docker-based build process which uses a directory bind mount to access the source files.
  • [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to process and potentially modify C source code and markdown documentation. This constitutes a vulnerability surface where instructions embedded in code or comments could attempt to influence the agent's logic.
  • Ingestion points: Source files in assets/gameplay-lab/src/ and assets/gameplay-lab/inc/.
  • Boundary markers: No explicit delimiters are used to separate code from instructions.
  • Capability inventory: File system access and shell command execution capabilities are available to the agent for building projects.
  • Sanitization: No specific sanitization or filtering is performed on the ingested source code content.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 06:24 AM