scenario-roblox-tooling

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The Python script scripts/rbx_tooling.py uses subprocess.run to orchestrate various Roblox development tools including Rojo, Wally, Lune, luau-lsp, Selene, and StyLua. This is standard behavior for a build and test pipeline.
  • [EXTERNAL_DOWNLOADS]: The GitHub Actions workflow templates (ci.yml, publish.yml) included in the scaffold download the rokit toolchain directly from its official GitHub repository (rojo-rbx/rokit). These are well-known tools in the Roblox developer ecosystem.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: Several scripts (check_key.luau, cloud_luau.luau, publish.luau, restart_servers.luau, place_versions.luau) handle the ROBLOX_API_KEY for authentication. The skill correctly implements security best practices by reading the key from the environment rather than hardcoding it and using it only for requests to official apis.roblox.com endpoints.
  • [DYNAMIC_EXECUTION]: The cloud_luau.luau script enables the execution of arbitrary Luau code on Roblox servers via the Open Cloud Luau Execution API. This is the intended primary purpose of the tool for running engine-side tests in CI. Additionally, TestRunner.luau and test.luau dynamically load and execute local specification files using require.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 04:39 PM