vita-port

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided source code (C/C++, Java) as part of the porting workflow. The scripts/audit_source.py script performs regex-based scanning of these external files. While this creates a surface for processing untrusted data, the logic is limited to identification and reporting, and the skill provides clear boundary instructions regarding the legal scope of the source material.
  • [COMMAND_EXECUTION]: The workflow relies on standard development and build tools including cmake, make, and the vitasdk toolchain. The skill provides several Python and Bash scripts to facilitate this, such as check_env.sh for environment verification and check_vpk.py for binary validation. These scripts perform routine filesystem operations consistent with the skill's stated purpose as a developer tool.
  • [EXTERNAL_DOWNLOADS]: The skill references numerous external resources, including the official vitasdk toolchain manager (vdpm) and well-known community repositories for game engines and porting libraries. It also mentions third-party services like pullpush.io for accessing public archives. These references are documented neutrally as standard requirements for the PlayStation Vita development ecosystem.
  • [PROMPT_INJECTION]: A deterministic detector flagged a potential concealment attempt in references/port-types.md. Manual review confirms this is a false positive: the text describes a third-party project whose source code is currently private, rather than an attempt by the agent to hide its own instructions or actions from the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 06:01 PM