[oliver-the-multiworld-squirrel]

Hey folks, I found a bunch of new updates for 20 worlds. I'm gonna grab some info on them for y'all.

Location: MultiworldGG/MultiworldGG-Beta@worlds-wheels-2026-10-17
Release tag: worlds-wheels-2026-10-17
APWorlds: alttpr, brotato, build_a_jetpack, cv_dos, dredge, ff4fe, isles_of_trials, ladx, mmzero3, momodoramoonlitfarewell, outer_wilds, pokemon_crystal, pokemon_frlg, rac3, silksong, stardew_valley, taylorswift, tloz_ph, ttyd, wario_ware_inc

• alttpr: worlds_alttpr-1.6.1-py3-none-any.whl (1.15 MB)
• brotato: worlds_brotato-0.17.1-py3-none-any.whl (51 KB)
• build_a_jetpack: worlds_build_a_jetpack-0.2.0-py3-none-any.whl (8.9 KB)
• cv_dos: worlds_cv_dos-3.1.0-py3-none-any.whl (105 KB)
• dredge: worlds_dredge-0.7.0-py3-none-any.whl (42 KB)
• ff4fe: worlds_ff4fe-0.0.1-py3-none-any.whl (56 KB)
• isles_of_trials: worlds_isles_of_trials-0.2.0-py3-none-any.whl (6.6 KB)
• ladx: worlds_ladx-2.0.2-py3-none-any.whl (356 KB)
• mmzero3: worlds_mmzero3-0.4.1-py3-none-any.whl (209 KB)
• momodoramoonlitfarewell: worlds_momodoramoonlitfarewell-1.8.1-py3-none-any.whl (17 KB)
• outer_wilds: worlds_outer_wilds-1.3.1-py3-none-any.whl (96 KB)
• pokemon_crystal: worlds_pokemon_crystal-6.0.4-py3-none-any.whl (983 KB)
• pokemon_frlg: worlds_pokemon_frlg-1.1.5-py3-none-any.whl (1.51 MB)
• rac3: worlds_rac3-0.6.3-py3-none-any.whl (2.78 MB)
• silksong: worlds_silksong-0.5.1-py3-none-any.whl (1.53 MB)
• stardew_valley: worlds_stardew_valley-8.1.8-py3-none-any.whl (595 KB)
• taylorswift: worlds_taylorswift-1.3.0-py3-none-any.whl (29 KB)
• tloz_ph: worlds_tloz_ph-0.10.2-py3-none-any.whl (2.53 MB)
• ttyd: worlds_ttyd-0.14.1-py3-none-any.whl (1.56 MB)
• wario_ware_inc: worlds_wario_ware_inc-1.1.2-py3-none-any.whl (36 KB)

Karen Head of Multiworld QA bot is gathering the manifests for 20 worlds and cross referencing. She'll review them individually in a moment.

[karen-head-of-multiworld-qa]

Karen: Quality Assurance Manager

Here to give a seal of quality to your APWorld, because no one wants to be a vector for an exploit.
Overall: ❌ FAIL (19 world(s) checked)

alttpr — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	2 dependency(ies) audited, no known advisories.

brotato — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

build_a_jetpack — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

cv_dos — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

dredge — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

ff4fe — ❌ fail

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	❌ fail	Found 36 known vulnerabilities and no adverse project statuses in 4 packages

Details

pip_audit

• pillow 12.1.1 has 36 known vulnerabilities:
• • PYSEC-2026-3453: Pillow: Controlled heap out-of-bounds write in Pillow ImageCmsTransform.apply() via output mode mismatch
• • PYSEC-2026-165: Pillow has an integer overflow when processing fonts
• • PYSEC-2026-3452: Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service
• • PYSEC-2026-3451: Pillow: Heap out-of-bounds write Image.paste() / Image.crop() via signed coordinate overflow
• • PYSEC-2026-3495: Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
• • PYSEC-2026-3494: Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
• • PYSEC-2026-165: No summary provided
• • PYSEC-2026-3496: Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
• • PYSEC-2026-2250: FITS GZIP decompression bomb in Pillow
• • PYSEC-2026-2255: No summary provided
• • PYSEC-2026-2256: No summary provided
• • PYSEC-2026-2251: No summary provided
• • PYSEC-2026-2252: No summary provided
• • PYSEC-2026-3494: Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images
• • PYSEC-2026-2254: No summary provided
• • PYSEC-2026-3495: Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()
• • PYSEC-2026-3493: Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
• • PYSEC-2026-2255: Pillow BdfFontFile: Image.new() called without _decompression_bomb_check() — bomb protection bypass via font loading
• • PYSEC-2026-3451: No summary provided
• • PYSEC-2026-2252: Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
• • PYSEC-2026-3452: No summary provided
• • PYSEC-2026-2250: No summary provided
• • PYSEC-2026-2254: Pillow: FontFile.compile(): Image.new() called without _decompression_bomb_check()
• • PYSEC-2026-2874: Pillow has a PDF Parsing Trailer Infinite Loop (DoS)

isles_of_trials — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

ladx — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	1 dependency(ies) audited, no known advisories.

mmzero3 — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

momodoramoonlitfarewell — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

outer_wilds — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

pokemon_crystal — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

pokemon_frlg — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	1 dependency(ies) audited, no known advisories.

rac3 — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

silksong — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	1 dependency(ies) audited, no known advisories.

stardew_valley — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

tloz_ph — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

ttyd — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	1 dependency(ies) audited, no known advisories.

wario_ware_inc — ✅ pass

Check	Status	Notes
schema	✅ pass	archipelago.json looking good!
manifest_consistency	✅ pass	filename, url, and JSON shape are all consistent, nice!
url_reachability	✅ pass	1 URLs are right where I looked
pip_audit	✅ pass	no declared dependencies to audit

There are some problems I'm not willing to overlook. Please fix them and try again.

[github-actions]

IGDB PR lookup

Karen flagged this PR as needing an IGDB id. Pick a candidate from the list below, edit worlds/<apworld>.json to add "igdb_id": <number>, and remove the Needs IGDB id label when done. If no candidate fits, search IGDB directly.

• ❓ build_a_jetpack: no IGDB matches for Build a Jetpack. Search IGDB manually.

• ❓ isles_of_trials: no IGDB matches for Isles of Trials. Search IGDB manually.

• ❓ silksong (Hollow Knight: Silksong):

  • Hollow Knight Silksong - Sea of Sorrow — id 381684, 2026
  • Hollow Knight Silksong — id 372563, 2021
  • Hollow Knight Silksong — id 115289, 2025

• ❓ taylorswift: no IGDB matches for Taylor Swift Discography. Search IGDB manually.

[karen-head-of-multiworld-qa]

Karen: Isolated QA Checks

World generation (fuzzer) results

alttpr - ⚠️ warn

Check	Status	Notes
fuzzer	⚠️ warn	success=0 failure=0 timeout=0 ignored=10 rom=0 real=0 total=10
bandit	❌ fail	34 issues(s), we should look it over.
size	✅ pass	a very reasonable 5.0MB / cap 250MB
rom	✅ pass	no illegal games here
net	⚠️ warn	10 top-level network module imports, these are probably ok, but check them out.
ruff	captured	2337 linter flags

Findings

bandit

• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/Gui.py:61 [B103/MEDIUM] Chmod setting a permissive mask 0o755 on file (NOT PARSED).
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/MultiServer.py:423 [B310/MEDIUM] Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/MultiServer.py:423 [B323/MEDIUM] By default, Python will create a secure, verified ssl context for use in such classes as HTTPSConnection. However, it still allows using an insecure context via the _create_unverified_context that reverts to the previous behavior that does not validate certificates or perform hostname checks.
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/Plando.py:31 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/Rom.py:102 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/Rom.py:151 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/Rom.py:159 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/Rom.py:183 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/Rom.py:216 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/TestSuite.py:36 [B602/HIGH] subprocess call with shell=True identified, security issue.
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/TestSuiteStat.py:93 [B602/HIGH] subprocess call with shell=True identified, security issue.
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/Utils.py:129 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/Utils.py:773 [B310/MEDIUM] Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/debug_restricted_cave.py:118 [B608/MEDIUM] Possible SQL injection vector through string-based query construction.
• /work/extracted/worlds/alttpr/ALttPDoorRandomizer/resources/ci/common/common.py:150 [B103/MEDIUM] Chmod setting a permissive mask 0o755 on file (BUILD_FILENAME).
• …and 19 more

net

• worlds/alttpr/Rom.py: top-level from urllib.request import ... at line 10
• worlds/alttpr/ALttPDoorRandomizer/Utils.py: top-level import urllib.request at line 13
• worlds/alttpr/ALttPDoorRandomizer/MultiServer.py: top-level import urllib.request at line 10
• worlds/alttpr/ALttPDoorRandomizer/resources/ci/common/list_actions.py: top-level import urllib.request at line 8
• worlds/alttpr/ALttPDoorRandomizer/resources/ci/common/get_upx.py: top-level import urllib.request at line 4
• worlds/alttpr/ALttPDoorRandomizer/resources/ci/common/get_get_pip.py: top-level import urllib.request at line 4
• worlds/alttpr/ALttPDoorRandomizer/source/tools/MysteryUtils.py: top-level import urllib.request at line 6
• worlds/alttpr/ALttPDoorRandomizer/source/classes/SpriteSelector.py: top-level from urllib.parse import ... at line 8
• worlds/alttpr/ALttPDoorRandomizer/source/classes/SpriteSelector.py: top-level from urllib.request import ... at line 9
• worlds/alttpr/ALttPDoorRandomizer/source/classes/CustomSettings.py: top-level import urllib.request at line 2

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

brotato - ⚠️ warn

Check	Status	Notes
fuzzer	⚠️ warn	success=5 failure=0 timeout=2 ignored=3 rom=0 real=0 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 0.2MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	8 linter flags

Findings

fuzzer

• <class 'TimeoutError'> (2)

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

build_a_jetpack - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=10 failure=0 timeout=0 ignored=0 rom=0 real=0 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 0.0MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	16 linter flags

Findings

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

cv_dos - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=10 failure=0 timeout=0 ignored=0 rom=0 real=0 total=10
bandit	❌ fail	1 issues(s), we should look it over.
size	✅ pass	a very reasonable 0.4MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	82 linter flags

Findings

bandit

• /work/extracted/worlds/cv_dos/Rom.py:453 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

dredge - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=10 failure=0 timeout=0 ignored=0 rom=0 real=0 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 0.3MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	60 linter flags

Findings

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

ff4fe - ❌ fail

Check	Status	Notes
fuzzer	❌ fail	success=4 failure=6 timeout=0 ignored=0 rom=0 real=6 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 0.2MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	91 linter flags

Findings

fuzzer

• 'Adamant' (5)
• FillError (1)

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

isles_of_trials - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=10 failure=0 timeout=0 ignored=0 rom=0 real=0 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 0.0MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	18 linter flags

Findings

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

ladx - ⚠️ warn

Check	Status	Notes
fuzzer	⚠️ warn	success=9 failure=1 timeout=0 ignored=0 rom=0 real=1 total=10
bandit	❌ fail	4 issues(s), we should look it over.
size	✅ pass	a very reasonable 1.1MB / cap 250MB
rom	✅ pass	no illegal games here
net	⚠️ warn	1 top-level network module imports, these are probably ok, but check them out.
ruff	captured	657 linter flags

Findings

fuzzer

• FillError (1)

bandit

• /work/extracted/worlds/ladx/LADXR/getGFX.py:7 [B113/MEDIUM] Call to requests without timeout
• /work/extracted/worlds/ladx/LADXR/getGFX.py:14 [B113/MEDIUM] Call to requests without timeout
• /work/extracted/worlds/ladx/LADXR/patches/titleScreen.py:26 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False
• /work/extracted/worlds/ladx/Rom.py:87 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False

net

• worlds/ladx/LADXR/getGFX.py: top-level import requests at line 1

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

mmzero3 - ⚠️ warn

Check	Status	Notes
fuzzer	⚠️ warn	success=5 failure=0 timeout=5 ignored=0 rom=0 real=0 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 0.8MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	197 linter flags

Findings

fuzzer

• <class 'TimeoutError'> (5)

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

momodoramoonlitfarewell - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=10 failure=0 timeout=0 ignored=0 rom=0 real=0 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 0.1MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	26 linter flags

Findings

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

outer_wilds - ⚠️ warn

Check	Status	Notes
fuzzer	⚠️ warn	success=0 failure=0 timeout=0 ignored=10 rom=0 real=0 total=10
bandit	❌ fail	2 issues(s), we should look it over.
size	✅ pass	a very reasonable 0.5MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	161 linter flags

Findings

bandit

• /work/extracted/worlds/outer_wilds/shared_static_logic/hash_file.py:11 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False
• /work/extracted/worlds/outer_wilds/test/test_pickle_file.py:13 [B301/MEDIUM] Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

pokemon_crystal - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=10 failure=0 timeout=0 ignored=0 rom=0 real=0 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 4.3MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	512 linter flags

Findings

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

pokemon_frlg - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=10 failure=0 timeout=0 ignored=0 rom=0 real=0 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 4.4MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	633 linter flags

Findings

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

rac3 - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=7 failure=0 timeout=0 ignored=3 rom=0 real=0 total=10
bandit	❌ fail	4 issues(s), we should look it over.
size	✅ pass	a very reasonable 3.6MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	145 linter flags

Findings

bandit

• /work/extracted/worlds/rac3/client/client.py:375 [B608/MEDIUM] Possible SQL injection vector through string-based query construction.
• /work/extracted/worlds/rac3/pypine/pypine/pine.py:123 [B108/MEDIUM] Probable insecure usage of temp file/directory.
• /work/extracted/worlds/rac3/pypine/pypine/pine.py:133 [B108/MEDIUM] Probable insecure usage of temp file/directory.
• /work/extracted/worlds/rac3/pypine/pypine/pine.py:137 [B108/MEDIUM] Probable insecure usage of temp file/directory.

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

silksong - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=9 failure=0 timeout=0 ignored=1 rom=0 real=0 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 24.6MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	188 linter flags

Findings

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

stardew_valley - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=10 failure=0 timeout=0 ignored=0 rom=0 real=0 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 2.5MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	3688 linter flags

Findings

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

taylorswift - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=10 failure=0 timeout=0 ignored=0 rom=0 real=0 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 0.1MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	16 linter flags

Findings

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

tloz_ph - ❌ fail

Check	Status	Notes
fuzzer	❌ fail	success=3 failure=7 timeout=0 ignored=0 rom=0 real=7 total=10
bandit	✅ pass	Bandit didn't make out with anything worth mentioning.
size	✅ pass	a very reasonable 3.7MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	375 linter flags

Findings

fuzzer

• Phantom Hourglass: failed GER after 10 attempts. (5)
• list.remove(x): x not in list (2)

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

ttyd - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=10 failure=0 timeout=0 ignored=0 rom=0 real=0 total=10
bandit	❌ fail	1 issues(s), we should look it over.
size	✅ pass	a very reasonable 4.3MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	772 linter flags

Findings

bandit

• /work/extracted/worlds/ttyd/Rules.py:158 [B307/MEDIUM] Use of possibly insecure function - consider using safer ast.literal_eval.

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

wario_ware_inc - ✅ pass

Check	Status	Notes
fuzzer	✅ pass	success=3 failure=0 timeout=0 ignored=7 rom=0 real=0 total=10
bandit	❌ fail	2 issues(s), we should look it over.
size	✅ pass	a very reasonable 0.1MB / cap 250MB
rom	✅ pass	no illegal games here
net	✅ pass	Only network I see is the one I'm responding on.
ruff	captured	91 linter flags

Findings

bandit

• /work/extracted/worlds/wario_ware_inc/rom.py:24 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False
• /work/extracted/worlds/wario_ware_inc/rom.py:133 [B324/HIGH] Use of weak MD5 hash for security. Consider usedforsecurity=False

ruff

• Run pip install ruff && ruff check --fix on your repo to fix many of these

[karen-head-of-multiworld-qa]

Karen can't sign off yet - the manifest checks and the isolated QA checks (fuzz/scan) did not pass. See Karen's review and the Isolated QA Checks comment for the breakdown.