roblox-datastores
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external Roblox DataStores, creating a potential surface for indirect prompt injection if the stored data is untrusted and processed by the agent without sufficient sanitization.
- Ingestion points:
store:GetAsync(key)andstore:GetSortedAsync()used inSKILL.mdandreferences/sessions-and-limits.mdto load player progress and leaderboard data. - Boundary markers: None identified; code snippets process retrieved data as Luau tables without explicit delimiters or injection warnings.
- Capability inventory: The skill uses
SetAsync,UpdateAsync, andIncrementAsyncwhich perform network operations to Roblox's cloud infrastructure. - Sanitization: Not addressed; the logic primarily focuses on merging and persisting data tables rather than validating content against injection patterns.
Audit Metadata