The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides tools like script_read, search_game_tree, and console_output that allow an AI agent to ingest data from the Roblox data model. Because this data (script content, instance names, and log messages) can be controlled by external actors in shared environments or through imported assets, it constitutes a surface for indirect prompt injection attacks.
[REMOTE_CODE_EXECUTION]: The execute_luau tool allows the AI agent to run arbitrary Luau code inside the active Roblox Studio session. The documentation correctly identifies this as a privileged operation that can access HTTP services and Studio-stored credentials, which is an inherent risk of the MCP implementation being managed.
[COMMAND_EXECUTION]: The connection guide provides specific shell commands and JSON configurations that instruct the AI client to execute local binaries (e.g., mcp.bat on Windows or StudioMCP on macOS) to initialize the MCP server process.

roblox-mcp