roblox-code
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/check.pyscript executes local development tools likerojo,lune,selene, andstyluausing thesubprocess.runfunction. The implementation securely passes command arguments as a list and avoids usingshell=True, which effectively prevents command injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The
scripts/new_project.pyscript generates anaftman.tomlconfiguration that pins versions for official Roblox development tools. These tools are sourced from well-known community repositories on GitHub (e.g.,rojo-rbx,UpliftGames,lune-org) and are managed by a standard toolchain manager, ensuring a consistent and verified build environment. - [DYNAMIC_EXECUTION]: The skill includes a headless test runner (
lune/test.luau) that dynamically loads test files with the.spec.luauextension using therequirefunction. This is standard functionality for testing frameworks to discover and run local unit tests. - [DATA_EXPOSURE]: Documentation within the skill guides the user to manage local environment settings, such as tool paths, in a
LOCAL.mdfile. The instructions correctly emphasize that this file is for local use only and should not be shared or committed, adhering to best practices for handling environment-specific data.
Audit Metadata