roblox-testing

Fail

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: CRITICALEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the TestEZ testing framework and official Roblox developer documentation for performance profiling and debugging.
  • Evidence: Links to https://github.com/Roblox/testez, https://roblox.github.io/testez/, and official https://create.roblox.com/ documentation are provided. These are well-known services in the Roblox ecosystem and are considered safe references.
  • [DYNAMIC_EXECUTION]: A custom test runner executes test functions dynamically to verify code behavior during development and debugging.
  • Evidence: scripts/TestRunner.lua uses pcall and xpcall to execute functions passed to it and describe blocks. This is standard and expected behavior for a testing framework implementation.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides tools for analyzing application logs and performance data, which could serve as an attack surface for indirect prompt injection if logs contain malicious instructions.
  • Ingestion points: Developer Console logs, Script Profiler outputs, and memory snapshots described in SKILL.md.
  • Boundary markers: None explicitly implemented in the provided scripts for log data processing.
  • Capability inventory: Console output logging (Logger.lua), 3D visual debugging (DebugDraw.lua), and local test execution (TestRunner.lua).
  • Sanitization: SKILL.md includes explicit guidance and code examples for sanitizing player data and identifiers before logging, reducing the risk of sensitive data exposure.
Recommendations
  • Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Oct 22, 2026, 02:46 PM