sgdk-release

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill includes a standalone Python utility (scripts/release.py) that performs technical validation of Sega Genesis ROM binaries. The script relies entirely on standard libraries and uses atomic file operations (temporary files and hard links) to safely generate release archives.
  • [EXTERNAL_DOWNLOADS]: The skill references a Docker image ewrogers/sgdk:latest for creating build environments. As this image is associated with the skill author, it is a recognized vendor resource for the intended workflow.
  • [COMMAND_EXECUTION]: The instructions involve executing Docker commands and a local Python script to build and package game assets. These operations are standard for development tasks and are scoped to the user's project directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data (ROM binaries and metadata documents) to generate distribution manifests and ZIP archives.
  • Ingestion points: The scripts/release.py script reads binary data and text files provided by the user from the local filesystem.
  • Boundary markers: The utility performs structural validation, including SEGA header checks, vector verification, and ELF signature matching, before files are accepted for packaging.
  • Capability inventory: The script is limited to local file reads, archive generation, and atomic filesystem links within the project scope.
  • Sanitization: Input values like game names and version strings are sanitized and slugified to prevent path traversal or malformed archive entries.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 03:06 AM