scenario-roblox-luau
Warn
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/rbx_luau.pyexecutes system commands usingsubprocess.runto interact with external development tools. Specifically, it calls therojobinary to generate sourcemaps and thelunebinary to execute Luau audit scripts on Roblox place files and source directories.\n- [DYNAMIC_EXECUTION]: The skill provides functionality to execute Luau code within a Roblox Studio environment. Therunfunction inscripts/rbx_luau.pytakes Luau code strings as input and sends them to a connected Studio session via an MCP interface for execution.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external Luau source code and Roblox place files, creating a surface for indirect instructions to be processed by the agent.\n - Ingestion points:
scripts/rbx_luau.pyreads Luau files and Roblox places via theauditandtypecheckfunctions.\n - Boundary markers: The skill does not implement explicit delimiters or warnings to ignore instructions embedded within the processed Luau code or Roblox assets.\n
- Capability inventory: The skill can execute system commands via
subprocess.runand run Luau code in a Studio session.\n - Sanitization: Input paths are resolved using
Path.resolve(), but the content of the Luau files is processed as raw text for static analysis.
Audit Metadata