roblox-experience-designer
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The provided
scripts/run.shscript is used to execute the agent locally. It uses standard bash practices and references a local runner script (run-skill.py) without involving untrusted external commands or network downloads. - [DATA_EXFILTRATION]: No evidence of unauthorized data access or exfiltration. While the documentation mentions the use of
HttpService:PostAsync()for exporting analytics to external BI tools, this is presented as a legitimate advanced capability for game developers and does not include any malicious URLs or automated exfiltration logic. - [REMOTE_CODE_EXECUTION]: The skill does not attempt to download or execute remote code. All code provided consists of local Lua templates for Roblox-specific services (DataStore, MarketplaceService) and a local shell script.
- [PROMPT_INJECTION]: The instructions do not contain any patterns intended to bypass AI safety guardrails or override system instructions. The content is strictly focused on Roblox game design and monetization ethics.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials, API keys, or secrets were found in the skill or the provided code snippets. Recommendations for secret management (like using environment variables or dedicated stores) are consistent with best practices.
Audit Metadata