roblox-texture-gen
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied texture styles and target object names which are interpolated into Luau code for execution within Roblox Studio via the
execute_luautool. - Ingestion points: User-provided style descriptions and Roblox object names in
SKILL.md. - Boundary markers: None; instructions are directly interpolated into Luau scripts.
- Capability inventory: Execution of Luau scripts in Roblox Studio, local Python script execution, and starting a local HTTP server.
- Sanitization: The skill recommends manual verification of object names using
inspect_instanceand the Python script encodes the prompt viaurllib.parse.quotefor the external API call. - [EXTERNAL_DOWNLOADS]: Fetches AI-generated texture images from the Pollinations.ai API (
image.pollinations.ai). This is the primary function of the skill and uses a well-known external service. - [COMMAND_EXECUTION]: Executes a local Python script to handle API interactions and starts a temporary local HTTP server bound to
127.0.0.1to serve generated assets to the Roblox Studio MCP tool.
Audit Metadata