scenario-roblox-tooling
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The Python script
scripts/rbx_tooling.pyusessubprocess.runto orchestrate various Roblox development tools including Rojo, Wally, Lune, luau-lsp, Selene, and StyLua. This is standard behavior for a build and test pipeline. - [EXTERNAL_DOWNLOADS]: The GitHub Actions workflow templates (
ci.yml,publish.yml) included in the scaffold download therokittoolchain directly from its official GitHub repository (rojo-rbx/rokit). These are well-known tools in the Roblox developer ecosystem. - [DATA_EXPOSURE_AND_EXFILTRATION]: Several scripts (
check_key.luau,cloud_luau.luau,publish.luau,restart_servers.luau,place_versions.luau) handle theROBLOX_API_KEYfor authentication. The skill correctly implements security best practices by reading the key from the environment rather than hardcoding it and using it only for requests to officialapis.roblox.comendpoints. - [DYNAMIC_EXECUTION]: The
cloud_luau.luauscript enables the execution of arbitrary Luau code on Roblox servers via the Open Cloud Luau Execution API. This is the intended primary purpose of the tool for running engine-side tests in CI. Additionally,TestRunner.luauandtest.luaudynamically load and execute local specification files usingrequire.
Audit Metadata