roblox-datastores
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements patterns for loading and saving player data via Roblox DataStoreService, which constitutes a potential attack surface for instructions embedded in external game data.
- Ingestion points: The skill uses
store:GetAsync(key)andstore:UpdateAsync(key)inSKILL.mdto fetch player data from a remote service into the execution environment. - Boundary markers: There are no explicit instructions to the agent to treat this data as untrusted or to ignore embedded instructions within the Luau code patterns.
- Capability inventory: The skill has the capability to write to persistent storage via
SetAsync,UpdateAsync, andIncrementAsync, and to influence player state viaplayer:SetAttribute. - Sanitization: The patterns focus on ensuring data is JSON-serializable but do not include explicit logic for sanitizing the content of the strings or tables retrieved from the DataStore.
- [EXTERNAL_DOWNLOADS]: The skill references an official Roblox documentation URL for supplemental information on service limits and error codes.
- Source:
https://create.roblox.com/docs/cloud-services/data-stores/error-codes-and-limitsmentioned inreferences/sessions-and-limits.md.
Audit Metadata