The Agent Skills Directory

[COMMAND_EXECUTION]: The skill enables and documents the execute_luau tool, allowing AI agents to run arbitrary code within a Roblox Studio session. This capability grants access to sensitive Roblox APIs, including network requests, DataStore access, and place publishing (documented in references/tool-reference.md).
[PROMPT_INJECTION]: The skill facilitates an indirect prompt injection attack surface (Category 8) by design.
Ingestion points: Tools such as script_read, inspect_instance, and search_game_tree ingest external, potentially untrusted data from the Roblox game model into the agent's context.
Boundary markers: The instructions do not implement explicit boundary markers or delimiters to isolate data from instructions when reading from the workspace.
Capability inventory: The agent possesses high-privilege capabilities including script modification via multi_edit and code execution via execute_luau across all scripts.
Sanitization: The Luau scripts provided (scripts/MCPReadyChecker.lua and scripts/StudioModelProbe.lua) do not perform filtering or sanitization of instance properties or script content before they are returned to the agent.

roblox-mcp