roblox-mm2-analytics-toolkit

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill document outlines an analytics toolkit for a Roblox game, but line 36 clones from an external domain (8015238355.github.io) into a repository path (murder-mystery-dupe-roblox), which exhibits characteristics of deceptive external content delivery.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (critical risk: 1.00). The installation instructions direct the user to clone a repository from a suspicious GitHub Pages domain (https://8015238355.github.io) associated with a deceptive Roblox duping repository name.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (critical risk: 1.00). The skill documentation instructs users to clone and execute an installation script from an external domain associated with Roblox game item duplication, which is a common vector for credential theft and malicious payloads disguised as gaming utilities.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs cloning from an arbitrary GitHub Pages domain (8015238355.github.io) with weak provenance and potential security risks, presenting a high-tier unverifiable operational dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill prompt instructs the agent to clone an external repository from a suspicious domain and run an automated shell script, which is a common pattern for potential supply chain or malicious execution vectors.