skills/justinedevs/roblox-ai-os/forge/Gen Agent Trust Hub

forge

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The workflow involves executing local CLI commands such as rcs state write and ai-slop-cleaner to manage project state and sanitize code output during the development loop.
  • [DYNAMIC_EXECUTION]: The skill is designed to implement and verify Roblox Luau scripts. It includes defensive instructions to recognize and avoid 'remote-code-loading smells' and exploitable patterns by referencing a local security corpus (corpora/security/roblox-unsafe-script-corpus/), explicitly forbidding the use of its contents in production code.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided blueprints and task descriptions to generate implementation code, which represents a potential attack surface.
  • Ingestion points: User-supplied task statements and approved blueprints provided to the $forge workflow (SKILL.md).
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands are defined for the input data processing in this file.
  • Capability inventory: Writing to project state files in the .rcs/ directory and executing local CLI tools for state management and code sanitization (SKILL.md).
  • Sanitization: The workflow mandates a 'deslop' pass using the ai-slop-cleaner tool and subsequent regression testing to verify the integrity and safety of the generated code.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 11:36 AM
Security Audit — agent-trust-hub — forge