The Agent Skills Directory

[SAFE]: The skill includes a robust security and provenance audit in references/upstream-audit.md and references/game-studio-adaptation.md. These documents identify specific hazards in the provided Luau scripts, such as non-atomic data saves in DataManager.lua and missing schema validation in RemoteManager.lua. By explicitly identifying these weaknesses and instructing the agent not to use the modules verbatim, the skill demonstrates a high level of transparency and defensive design.
[SAFE]: Instructions in SKILL.md emphasize critical security practices for the Roblox platform, including server authority over rewards and persistence, mandatory validation of untrusted client payloads, and compliance with platform policies regarding monetization and gambling-like mechanics.
[DATA_EXPOSURE]: The resources/asset_library.md file contains numerical asset IDs. However, these are clearly labeled as unverified placeholders, and the skill includes instructions to resolve and verify all assets through the official Roblox catalog and specialized audit tools before use.
[INDIRECT_PROMPT_INJECTION]: The skill has a potential attack surface as it ingests data from live Roblox Studio places (scripts, game trees). This risk is mitigated by clear instructions to treat external data as untrusted and to validate all inputs against strict schemas and platform policies. Per the security guidelines, this is a standard surface for integration skills and is classified as low risk.
[COMMAND_EXECUTION]: The skill utilizes the Roblox_Studio MCP tool for interacting with the development environment. All operations are scoped to standard Studio editing and inspection tasks, with instructions focused on maintaining project architecture and naming conventions.

roblox-game-developer