roblox-performance-profiling

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external Roblox MicroProfiler snapshots, creating a potential surface for indirect prompt injection if scope labels, counter names, or other data fields within the captured snapshots contain malicious instructions.\n
  • Ingestion points: External data is ingested when the skill opens snapshots using execute_luau as described in SKILL.md and references/analysis-checklist.md.\n
  • Boundary markers: The instructions do not define specific delimiters or instructions for the agent to ignore potentially malicious content embedded within the performance data.\n
  • Capability inventory: The skill has access to list_roblox_studios and execute_luau, allowing it to identify Studio instances and run analysis scripts within the Roblox environment.\n
  • Sanitization: There is no mention of sanitizing or validating strings extracted from profiler data before they are processed by the agent.\n- [COMMAND_EXECUTION]: The skill uses environment-specific tools to capture performance data and execute Luau scripts. While these are powerful capabilities, their use is constrained by the skill's instructions to perform specific diagnostic tasks (e.g., measuring frame times, identifying bottlenecks) and includes integrity rules like disposing of sessions and iterators.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 09:26 AM