forge
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The workflow involves executing local CLI commands such as
rcs state writeandai-slop-cleanerto manage project state and sanitize code output during the development loop. - [DYNAMIC_EXECUTION]: The skill is designed to implement and verify Roblox Luau scripts. It includes defensive instructions to recognize and avoid 'remote-code-loading smells' and exploitable patterns by referencing a local security corpus (
corpora/security/roblox-unsafe-script-corpus/), explicitly forbidding the use of its contents in production code. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided blueprints and task descriptions to generate implementation code, which represents a potential attack surface.
- Ingestion points: User-supplied task statements and approved blueprints provided to the
$forgeworkflow (SKILL.md). - Boundary markers: No specific delimiters or instructions to ignore embedded commands are defined for the input data processing in this file.
- Capability inventory: Writing to project state files in the
.rcs/directory and executing local CLI tools for state management and code sanitization (SKILL.md). - Sanitization: The workflow mandates a 'deslop' pass using the
ai-slop-cleanertool and subsequent regression testing to verify the integrity and safety of the generated code.
Audit Metadata