roblox-scene-analysis

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [SAFE]: The skill is designed for diagnostic analysis of Roblox scenes using official Luau APIs provided by the SceneAnalysisService. It provides guidance on minimizing environment disruption by restoring camera states and stopping play mode after analysis.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from the Roblox runtime environment, which creates a potential surface for indirect prompt injection if the analyzed place contains malicious object names or metadata.
  • Ingestion points: Runtime data (ValueTable results) returned from the execute_luau tool, including script names and instance hierarchies (SKILL.md, references/query-map.md).
  • Boundary markers: The instructions recommend JSON-encoding results to avoid console flooding, but they do not define specific delimiters to prevent the agent from interpreting embedded strings in the runtime data as instructions.
  • Capability inventory: The agent can run arbitrary code via execute_luau and manage the studio state (list_roblox_studios, get_studio_state).
  • Sanitization: There are no explicit instructions to sanitize or escape strings retrieved from the Roblox environment before including them in reports.
  • [DYNAMIC_EXECUTION]: The skill generates and executes Luau code to perform its primary function of scene analysis.
  • Evidence: The agent is instructed to construct and run queries such as GetScriptMemoryAsync() and GetTriangleCompositionAsync() using the execute_luau tool based on templates provided in references/query-map.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 09:26 AM