The Agent Skills Directory

[DYNAMIC_EXECUTION]: The Python script scripts/rbx_monetization.py includes a kit_source function that reads local Luau source files and concatenates them into a single string. This generated code is then executed within the Roblox Studio environment using a sibling skill's tool (rbx_run). This pattern of runtime code assembly is used to inject the monetization toolkit into the game environment.
[COMMAND_EXECUTION]: The script scripts/rbx_monetization.py uses subprocess.run to execute the lune CLI tool. This is used to perform offline audits of Roblox place files (.rbxl/.rbxlx) by running the lune_mon_audit.luau script.
[DYNAMIC_EXECUTION]: The Catalog.luau script supports a custom product type that executes a grant function defined in the catalog data. This allows for arbitrary logic execution during the receipt processing phase if the catalog definition is modified.
[INDIRECT_PROMPT_INJECTION]: The MonAudit.luau script processes external script source code from the Roblox DataModel to identify monetization patterns. This represents an indirect injection surface where malicious code within an audited file could attempt to influence the agent's interpretation of the audit results.
Ingestion points: MonAudit.run(root) reads the Source property of LuaSourceContainer instances (scripts) found in the Roblox game model.
Boundary markers: Findings are returned as structured data with severity and rule names, which limits the impact of embedded text.
Capability inventory: The skill can execute shell commands via subprocess (Python) and run code in Studio via rbx_run (Luau).
Sanitization: The auditor strips comments from code before analysis but does not explicitly sanitize the source text before returning findings.

scenario-roblox-monetization