rbx-studio
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for managing local development processes, such as stopping the Rojo server using the
taskkillcommand. It also describes the configuration for MCP servers which involve executingnodeto run the server wrappers. - [DYNAMIC_EXECUTION]: The skill utilizes the
execute_luautool provided by the Roblox-Studio-MCP to run Luau code directly within a running Roblox Studio instance. This is the intended functionality for AI-assisted inspection and asset management. - [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface through the importation of third-party assets from the Roblox Creator Store. The skill explicitly mitigates this risk by establishing a mandatory security workflow that includes using the provided
scripts/scan_asset_malware.luauscript and instructing the user to remove all scripts from imported geometry/meshes.
Audit Metadata