roblox-config-and-flags
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous shell commands using
grepandsedto audit local Luau source files and YAML configuration. These commands are intended for local static analysis of the codebase.\n- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and process content from local project files, which establishes an attack surface for indirect prompt injection.\n - Ingestion points: Content is ingested from
src/**/*.luau,rblxsync.yml,.env, andaftman.tomlthrough file-reading commands.\n - Boundary markers: No explicit delimiters or 'ignore' instructions are provided for the content read from files, although the operations are restricted to specific regex-based searches.\n
- Capability inventory: The agent has the capability to read local files and execute shell commands (
grep,sed,rblxsync) based on the data found in the project environment.\n - Sanitization: The skill relies on the agent's interpretation of regex output and provides explicit cautions against running sensitive commands like
rblxsync runin a live production environment.
Audit Metadata