roblox-rojo
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the Rojo CLI and plugin from official and well-known sources, including GitHub releases, the Rokit toolchain manager, and the crates.io registry.
- [CREDENTIALS_UNSAFE]: The documentation explicitly warns users against committing sensitive credentials, such as .ROBLOSECURITY cookies or Open Cloud API keys, to version control systems. It recommends using dedicated deploy accounts and secret management in CI/CD pipelines.
- [COMMAND_EXECUTION]: The skill documents the intended and legitimate use of the Rojo CLI commands (e.g., init, serve, build, upload, syncback) for Roblox development workflows.
- [DATA_EXFILTRATION]: Network operations described (e.g., rojo serve, rojo upload) are standard functions of the developer tool and include security notes regarding loopback binding and host validation to prevent unauthorized access.
Audit Metadata