sgdk-memory

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The toolchain scripts tools/build.py and tools/account.py use subprocess.run to execute Docker commands. This is used to build the C project and run SGDK analysis tools (m68k-elf-size, m68k-elf-nm) in a controlled, platform-independent environment. The scripts correctly handle process timeouts and avoid shell injection by passing arguments as a list.
  • [EXTERNAL_DOWNLOADS]: The skill instructions and scripts refer to the Docker image ewrogers/sgdk:latest, which contains the M68K compiler and SGDK libraries. This resource is owned by the skill author and is necessary for the skill's primary function of building Mega Drive ROMs.
  • [INDIRECT_PROMPT_INJECTION]: The account.py script parses section and symbol information from user-supplied ELF files. While this creates a processing surface for untrusted data, the script implements robust validation by strictly ensuring that extracted address and size values are parsed as integers and ensuring they fall within the 64 KiB work RAM limit of the Mega Drive hardware.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 02:47 AM