roblox-testing
Fail
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the TestEZ testing framework and official Roblox developer documentation for performance profiling and debugging.
- Evidence: Links to
https://github.com/Roblox/testez,https://roblox.github.io/testez/, and officialhttps://create.roblox.com/documentation are provided. These are well-known services in the Roblox ecosystem and are considered safe references. - [DYNAMIC_EXECUTION]: A custom test runner executes test functions dynamically to verify code behavior during development and debugging.
- Evidence:
scripts/TestRunner.luausespcallandxpcallto execute functions passed toitanddescribeblocks. This is standard and expected behavior for a testing framework implementation. - [INDIRECT_PROMPT_INJECTION]: The skill provides tools for analyzing application logs and performance data, which could serve as an attack surface for indirect prompt injection if logs contain malicious instructions.
- Ingestion points: Developer Console logs, Script Profiler outputs, and memory snapshots described in
SKILL.md. - Boundary markers: None explicitly implemented in the provided scripts for log data processing.
- Capability inventory: Console output logging (
Logger.lua), 3D visual debugging (DebugDraw.lua), and local test execution (TestRunner.lua). - Sanitization:
SKILL.mdincludes explicit guidance and code examples for sanitizing player data and identifiers before logging, reducing the risk of sensitive data exposure.
Recommendations
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata