vita-port
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided source code (C/C++, Java) as part of the porting workflow. The
scripts/audit_source.pyscript performs regex-based scanning of these external files. While this creates a surface for processing untrusted data, the logic is limited to identification and reporting, and the skill provides clear boundary instructions regarding the legal scope of the source material. - [COMMAND_EXECUTION]: The workflow relies on standard development and build tools including
cmake,make, and thevitasdktoolchain. The skill provides several Python and Bash scripts to facilitate this, such ascheck_env.shfor environment verification andcheck_vpk.pyfor binary validation. These scripts perform routine filesystem operations consistent with the skill's stated purpose as a developer tool. - [EXTERNAL_DOWNLOADS]: The skill references numerous external resources, including the official
vitasdktoolchain manager (vdpm) and well-known community repositories for game engines and porting libraries. It also mentions third-party services likepullpush.iofor accessing public archives. These references are documented neutrally as standard requirements for the PlayStation Vita development ecosystem. - [PROMPT_INJECTION]: A deterministic detector flagged a potential concealment attempt in
references/port-types.md. Manual review confirms this is a false positive: the text describes a third-party project whose source code is currently private, rather than an attempt by the agent to hide its own instructions or actions from the user.
Audit Metadata