roblox-rojo

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references official installation sources for the Rojo toolchain, including GitHub releases from the rojo-rbx organization, the Rokit toolchain manager, and standard package registries like crates.io. These references are used for legitimate setup of the developer environment.
  • [COMMAND_EXECUTION]: Instructions cover standard CLI operations for Roblox development, such as rojo serve for live synchronization, rojo build for generating place files, and rojo upload for asset deployment. The documentation explicitly warns against hardcoding .ROBLOSECURITY cookies or Open Cloud API keys when using these commands.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines how to manage Roblox projects through filesystem structures and JSON configuration files. This creates a surface for processing external data, which is handled as part of the tool's core developer workflow.
  • Ingestion points: Filesystem paths, .project.json configuration files, and Luau source scripts mapped to Roblox instances.
  • Boundary markers: Implicitly defined by the Rojo project schema and Luau file extensions.
  • Capability inventory: Includes the ability to build binary/XML place files and upload assets to the Roblox platform via authenticated APIs.
  • Sanitization: The skill relies on the Rojo CLI's internal validation of project files and property types against the Roblox reflection database.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 09:53 PM