roblox-rojo
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official installation sources for the Rojo toolchain, including GitHub releases from the
rojo-rbxorganization, the Rokit toolchain manager, and standard package registries like crates.io. These references are used for legitimate setup of the developer environment. - [COMMAND_EXECUTION]: Instructions cover standard CLI operations for Roblox development, such as
rojo servefor live synchronization,rojo buildfor generating place files, androjo uploadfor asset deployment. The documentation explicitly warns against hardcoding.ROBLOSECURITYcookies or Open Cloud API keys when using these commands. - [INDIRECT_PROMPT_INJECTION]: The skill defines how to manage Roblox projects through filesystem structures and JSON configuration files. This creates a surface for processing external data, which is handled as part of the tool's core developer workflow.
- Ingestion points: Filesystem paths,
.project.jsonconfiguration files, and Luau source scripts mapped to Roblox instances. - Boundary markers: Implicitly defined by the Rojo project schema and Luau file extensions.
- Capability inventory: Includes the ability to build binary/XML place files and upload assets to the Roblox platform via authenticated APIs.
- Sanitization: The skill relies on the Rojo CLI's internal validation of project files and property types against the Roblox reflection database.
Audit Metadata