The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill manages persistent player state, representing an indirect prompt injection surface. Implementation includes validation logic (key size, payload size) and documentation recommending server-side validation to mitigate risks.
Ingestion points: SafeDataStore:getAsync in scripts/SafeDataStore.lua.
Boundary markers: Instructions explicitly warn never to trust client data and recommend service isolation.
Capability inventory: Persistent write access via SetAsync, UpdateAsync, and IncrementAsync.
Sanitization: Key and payload validation using HttpService:JSONEncode to ensure data integrity.
[DATA_EXPOSURE_AND_EXFILTRATION]: No unauthorized data exposure was found. References point exclusively to official Roblox documentation (create.roblox.com), which is a well-known and trusted service domain. No sensitive local file access or external network calls to untrusted domains were identified.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns, unauthorized script downloads, or dynamic code generation from untrusted inputs were identified in the provided scripts or documentation.

roblox-datastores