roblox-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted Luau code from pull requests, scripts, or user queries, creating a surface for indirect prompt injection where malicious comments in the code could attempt to influence the agent's behavior.
- Ingestion points: Processes external Luau code for exploits, performance audits, and modernization (SKILL.md).
- Boundary markers: The instructions do not specify the use of delimiters or clear separation between the agent's instructions and the untrusted code being reviewed.
- Capability inventory: The skill allows the agent to modify files ("Offer to apply fixes") and trigger external tool execution ("Studio playtest via roblox-studio-mcp") (SKILL.md).
- Sanitization: There are no requirements to sanitize or escape the content of the code scripts before processing them.
Audit Metadata