roblox-scene-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: The skill is designed for diagnostic analysis of Roblox scenes using official Luau APIs provided by the SceneAnalysisService. It provides guidance on minimizing environment disruption by restoring camera states and stopping play mode after analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Roblox runtime environment, which creates a potential surface for indirect prompt injection if the analyzed place contains malicious object names or metadata.
- Ingestion points: Runtime data (ValueTable results) returned from the
execute_luautool, including script names and instance hierarchies (SKILL.md, references/query-map.md). - Boundary markers: The instructions recommend JSON-encoding results to avoid console flooding, but they do not define specific delimiters to prevent the agent from interpreting embedded strings in the runtime data as instructions.
- Capability inventory: The agent can run arbitrary code via
execute_luauand manage the studio state (list_roblox_studios, get_studio_state). - Sanitization: There are no explicit instructions to sanitize or escape strings retrieved from the Roblox environment before including them in reports.
- [DYNAMIC_EXECUTION]: The skill generates and executes Luau code to perform its primary function of scene analysis.
- Evidence: The agent is instructed to construct and run queries such as
GetScriptMemoryAsync()andGetTriangleCompositionAsync()using theexecute_luautool based on templates provided inreferences/query-map.md.
Audit Metadata