scenario-roblox-environment
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Python script
scripts/rbx_environment.pyexecutes external development tools usingsubprocess.run. This includeslunefor offline Luau auditing,sipsfor image metadata extraction (macOS), and references torojofor project building. These operations are restricted to standard developer utilities necessary for the skill's primary purpose. - [DYNAMIC_EXECUTION]: The skill dynamically assembles Luau code in
scripts/rbx_environment.pyby inlining local Luau modules (Graybox, TerrainKit, etc.) before execution in the Roblox Studio environment. This runtime script generation is a core feature used to provide the agent with a programmable interface to the Roblox API and does not involve untrusted remote inputs. - [INDIRECT_PROMPT_INJECTION]: The skill processes structured data from Roblox place files (
.rbxl,.rbxlx) and JSON project configurations. While this represents an ingestion surface for untrusted data, the risk is minimal as the processing is performed using standard parsers (json.loads,roblox.deserializePlace) and is scoped to developer-controlled environment files.
Audit Metadata