Roblox Avatar Creator
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides Lua scripts intended for use within the Roblox Studio environment. These scripts use standard Roblox APIs like
MarketplaceServiceandHumanoidDescriptionfor avatar customization and purchase prompting. No dangerous shell commands or unauthorized execution patterns were found. - [DATA_EXFILTRATION]: No network operations to external or untrusted domains were detected. Data handling is localized to the Roblox platform's internal systems (e.g., DataStores and RemoteEvents).
- [CREDENTIALS_SAFE]: The skill does not contain hardcoded API keys, tokens, or secrets. It correctly instructs users to manage player data through Roblox's native
DataManagerandDataStorepatterns. - [PROMPT_INJECTION]: The instructions follow a standard persona-based format for technical specialists. There are no attempts to override safety filters or bypass platform guidelines.
- [DYNAMIC_EXECUTION]: The provided Lua code snippets are static templates for standard game development tasks. No use of
loadstringor other dynamic execution sinks was found. - [INDIRECT_PROMPT_INJECTION]: While the skill describes systems that ingest player data (e.g., outfit configurations), these are processed through the Roblox engine's structured
HumanoidDescriptionsystem, which has built-in platform-level sanitization for asset IDs and properties.
Audit Metadata