scenario-roblox-assets
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONOBFUSCATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/rbx_assets.pyexecutes external binaries, specificallyblenderandmagick(ImageMagick), viasubprocess.run. This is used for headless 3D mesh processing and texture conversion, which are core functions of the asset pipeline. - [DYNAMIC_EXECUTION]: The skill dynamically assembles and executes Luau code snippets within Roblox Studio using the
rbx_runutility. This allows the agent to interact with the Roblox engine APIs for mesh building (AssetService), auditing (AvatarCreationService), and previewing assets in the workspace. - [OBFUSCATION]: Asset data (meshes and textures) is encoded using Base64 and Zstd compression for transport between the Python environment and Roblox Studio. While these techniques are used to hide content in other contexts, here they serve as a documented performance optimization for transferring large binary payloads across the agent communication bridge.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external 3D files (GLB, FBX, OBJ) which may originate from untrusted sources or AI generators.
- Ingestion points: External 3D model files are read into the pipeline via
rbx_assets.pyand processed by Blender. - Boundary markers: Not applicable to binary geometric data, though the instructions treat AI-generated meshes as "raw input with known defects."
- Capability inventory: The skill can execute subprocesses (Blender/Magick), read/write local files, and execute code within the Roblox Studio environment.
- Sanitization: Geometry is processed via standard Blender operators (welding, decimation, hole filling) which reduces the risk of malicious geometric payloads, though the surface for indirect injection via mesh metadata or malformed binary headers is a known low-risk vector for this type of tool.
Audit Metadata