reference-decomp

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill references the zeldaret/ph repository on GitHub, which is a well-established and reputable community project for decompiling Zelda: Phantom Hourglass. The reference is used as context for prior work and does not involve downloading or executing untrusted code.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read source code and comments (such as // non-matching) from the reference repository to influence its decompilation workflow. This introduces a surface for indirect prompt injection if the reference data were to contain malicious instructions. However, the skill explicitly mitigates this risk by instructing the agent to treat the reference only as context and to rely on authoritative build artifacts and diff tooling for verification rather than source-level annotations.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 01:20 PM