sgdk-memory
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The toolchain scripts
tools/build.pyandtools/account.pyusesubprocess.runto execute Docker commands. This is used to build the C project and run SGDK analysis tools (m68k-elf-size,m68k-elf-nm) in a controlled, platform-independent environment. The scripts correctly handle process timeouts and avoid shell injection by passing arguments as a list. - [EXTERNAL_DOWNLOADS]: The skill instructions and scripts refer to the Docker image
ewrogers/sgdk:latest, which contains the M68K compiler and SGDK libraries. This resource is owned by the skill author and is necessary for the skill's primary function of building Mega Drive ROMs. - [INDIRECT_PROMPT_INJECTION]: The
account.pyscript parses section and symbol information from user-supplied ELF files. While this creates a processing surface for untrusted data, the script implements robust validation by strictly ensuring that extracted address and size values are parsed as integers and ensuring they fall within the 64 KiB work RAM limit of the Mega Drive hardware.
Audit Metadata