roblox-cloud
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill promotes secure integration practices for Roblox Open Cloud APIs, explicitly instructing the agent to use the platform's 'Secrets' management for API keys instead of hardcoding credentials. It also correctly targets the official 'apis.roblox.com' infrastructure for all cloud operations.
- [INDIRECT_PROMPT_INJECTION]: The skill describes how to process external webhook notifications from Roblox, which represents a surface for untrusted data ingestion.
- Ingestion points: External webhook POST payloads received by custom HTTPS endpoints as documented in references/webhooks-documentation.md.
- Boundary markers: The skill instructs the agent to validate the 'roblox-signature' header and check timestamp validity before processing content.
- Capability inventory: The skill facilitates standard HTTP request construction and documentation lookup; it does not authorize the execution of dangerous commands or system-level modifications based on the untrusted input.
- Sanitization: Mandatory HMAC-SHA256 signature verification and replay window checks are described to ensure data authenticity and mitigate injection risks.
Audit Metadata