roblox-code

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/check.py script executes local development tools like rojo, lune, selene, and stylua using the subprocess.run function. The implementation securely passes command arguments as a list and avoids using shell=True, which effectively prevents command injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The scripts/new_project.py script generates an aftman.toml configuration that pins versions for official Roblox development tools. These tools are sourced from well-known community repositories on GitHub (e.g., rojo-rbx, UpliftGames, lune-org) and are managed by a standard toolchain manager, ensuring a consistent and verified build environment.
  • [DYNAMIC_EXECUTION]: The skill includes a headless test runner (lune/test.luau) that dynamically loads test files with the .spec.luau extension using the require function. This is standard functionality for testing frameworks to discover and run local unit tests.
  • [DATA_EXPOSURE]: Documentation within the skill guides the user to manage local environment settings, such as tool paths, in a LOCAL.md file. The instructions correctly emphasize that this file is for local use only and should not be shared or committed, adhering to best practices for handling environment-specific data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 02:34 PM