sgdk-ui
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation and README instruct the user to build the project using the
ewrogers/sgdk:latestDocker image. This is a vendor-owned resource (authored byewrogers) used to provide a consistent cross-platform build environment for the SGDK C code. - [COMMAND_EXECUTION]: Includes a utility script
scripts/make_lab_font.pywhich is intended to be run by the user to regenerate font assets. The script uses standard Python libraries (argparse,pathlib,struct,zlib) to convert bitmask data into a PNG file and implements safety checks to prevent overwriting existing files. - [INDIRECT_PROMPT_INJECTION]: The skill provides functions (
menu_field,menu_number) to process and display text in the console's UI. While these are ingestion points for data, the execution context is restricted to the Sega Mega Drive's Video Display Processor (VDP) tilemaps, which lack network access or shell capabilities, posing no risk to the host system. - [SAFE]: References point to the official SGDK repository on GitHub (
Stephane-D/SGDK), which is a well-known open-source project for retro console development.
Audit Metadata