sgdk-gameplay
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The project build instructions reference a Docker image
ewrogers/sgdk:2.11-gcc16.2.0-binutils2.47from the author's repository. This image serves as the compilation environment for the Mega Drive ROM and is pinned with a SHA256 hash for integrity. - [COMMAND_EXECUTION]: The skill includes a Python script
scripts/make_lab_art.pywhich is intended to generate PNG assets for the gameplay lab. It also provides a shell command for running the Docker-based build process which uses a directory bind mount to access the source files. - [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to process and potentially modify C source code and markdown documentation. This constitutes a vulnerability surface where instructions embedded in code or comments could attempt to influence the agent's logic.
- Ingestion points: Source files in
assets/gameplay-lab/src/andassets/gameplay-lab/inc/. - Boundary markers: No explicit delimiters are used to separate code from instructions.
- Capability inventory: File system access and shell command execution capabilities are available to the agent for building projects.
- Sanitization: No specific sanitization or filtering is performed on the ingested source code content.
Audit Metadata