roblox-datastores

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements patterns for loading and saving player data via Roblox DataStoreService, which constitutes a potential attack surface for instructions embedded in external game data.
  • Ingestion points: The skill uses store:GetAsync(key) and store:UpdateAsync(key) in SKILL.md to fetch player data from a remote service into the execution environment.
  • Boundary markers: There are no explicit instructions to the agent to treat this data as untrusted or to ignore embedded instructions within the Luau code patterns.
  • Capability inventory: The skill has the capability to write to persistent storage via SetAsync, UpdateAsync, and IncrementAsync, and to influence player state via player:SetAttribute.
  • Sanitization: The patterns focus on ensuring data is JSON-serializable but do not include explicit logic for sanitizing the content of the strings or tables retrieved from the DataStore.
  • [EXTERNAL_DOWNLOADS]: The skill references an official Roblox documentation URL for supplemental information on service limits and error codes.
  • Source: https://create.roblox.com/docs/cloud-services/data-stores/error-codes-and-limits mentioned in references/sessions-and-limits.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 04:04 PM